In this article, For Clarity's Sake, Please Don't Say "Licensed under GNU GPL 2"!, Free Software Foundation president Richard Stallman (RMS) explains how to properly identify what GNU license your work is under. Whenever a developer releases their work under a GNU license, they have the option to either release it under that version of the license only, or to make it available under any later version of that license. This option ensures that software can remain compatible with future versions of the license. But what happens if someone just says their program is under GNU GPL version 2, for example?

[T]hey are leaving the licensing of the program unclear. Is it released under GPL-2.0-only, or GPL-2.0-or-later? Can you merge the code with packages released under GPL-3.0-or-later?

Thus, it is vitally important that developers indicate in their license notices whether they are licensing their work under that version "only" or under "any later version." Of course, these days it is also helpful for license notices to be machine-readable. The Software Package Data Exchange (SPDX) specification sets a standardized way of identifying licenses on software packages. They are updating their license identifiers to include this distinction in their upcoming version. For example, for GNU GPL version 2, the identifiers are now "GPL-2.0-only or GPL-2.0-or-later." The old identifiers (e.g. "GPL-2.0") are now deprecated and should no longer be used. Based on the changes SPDX says are coming in the SPDX specification and its Web site, the FSF expects to endorse the new version of the SPDX. We thank SPDX and their community for making these helpful changes.