91.1.0 (The Porsche 911 edition 😉)

What's Changed

🐞 Bug Fixes

• 9384472 cyclonedx: Map whitespace characters to always be valid
• 7eb33c8 yarn2: Avoid failing on ambiguously resolved locators

🎉 New Features

• c4403ba Tycho: Allow some configuration of the command line
• f503c9a model: Add firstFixedVersions field to Vulnerability
• 829f364 vulnerable-code: Populate firstFixedVersions for v1 API
• 9a99958 vulnerable-code: Populate firstFixedVersions for v3 API

✅ Tests

• ac7e276 osv: Temporarily disable a failing test due to an upstream issue
• 82bf51a osv: Update expected results

🐘 Build & ⚙️ CI

• 68d065f detekt: Correctly match all desired files
• 37312d5 gradle: Consistently apply XZ library specifics
• dda1a6c gradle: Make (plugin) implementation dependencies runtime-only
• 6912b51 gradle: Remove some unused dependencies
• 12b1adb gradle: Split up AsciidoctorJ API / implementation dependencies
• 5e3b178 spdx-expression: Fix up Jackson dependencies
• 6ec421b Avoid using a Project object as a dependency notation

🔧 Chores

• 6dc3a3d buildSrc: Address Detekt issues before enabling it
• 8214f59 buildSrc: Use property assignment via =
• afcad39 model: Correct the target type of a sorted set converter

🚀 Dependency Updates

• 2dba388 update actions/setup-node action to v7
• 4223495 update aws-java-sdk-v2 monorepo to v2.48.0
• cf44691 update aws-java-sdk-v2 monorepo to v2.48.1
• a316068 update ch.qos.logback:logback-classic to v1.5.38
• da50432 update com.autonomousapps.build-health to v3.16.1
• 11b76cd update com.autonomousapps.build-health to v3.17.0
• 30274e6 update com.icegreen:greenmail to v2.1.10
• 286899b update com.icegreen:greenmail to v2.1.11
• 42f3be2 update com.squareup:sort-dependencies-gradle-plugin to v0.20.0
• d710af6 update graalvm/setup-graalvm action to v1.6.3
• 980103e update ksp monorepo to v2.3.10
• 4672d8e update org.bouncycastle:bcprov-jdk18on to v1.85
• 24bb4eb update org.graalvm.buildtools:native-gradle-plugin to v1.1.4
• 65c0cfc update org.metaeffekt.core:ae-security to v0.156.4

91.0.1

What's Changed

🐞 Bug Fixes

• 2a80a71 osv: Fall back to a package-only query if the version is unknown

✅ Tests

• 1fa9e20 osv: Update expected results

🐘 Build & ⚙️ CI

• 3c3b440 gradle: Give some library catalog entries better names
• 844dc25 gradle: Remove Log4j API dependencies added by conventions
• 16a78b7 gradle: Remove a work-around that is not needed anymore
• a7cf3f2 github: Use mise instead of Flox to run isolated tests

📖 Documentation

• 4719cb3 cli: Improve a code comment about logging
• 8110285 gradle: Update the link to type-safe project accessors
• 1af47c3 Trim trailing whitespace from all Markdown files

🔧 Chores

• 5106a87 cli-test-launcher: Support setting the root log level
• ba8c031 flox: Remove all Flox environments in favor of only keeping mise
• 4baf3df mise: Do not run Gradle with --stacktrace by default

🚀 Dependency Updates

• 6d5f219 update actions/setup-java action to v5.5.0
• 2cdda8a update aws-java-sdk-v2 monorepo to v2.47.0
• 7dbab9a update aws-java-sdk-v2 monorepo to v2.47.2
• e13afb8 update com.fasterxml.jackson:jackson-bom to v2.22.1
• 356569e update com.networknt:json-schema-validator to v3.0.6
• 81ea07f update dependency prettier to v3.9.4
• 0937f7d update github/codeql-action action to v4.37.0
• da7c52b update graalvm/setup-graalvm action to v1.6.1
• b41ec08 update graalvm/setup-graalvm action to v1.6.2
• 0a9421b update kotest to v6.2.2
• 6347f97 update org.postgresql:postgresql to v42.7.13

🚜 Refactorings

• dcb1864 mise: Allow all tasks to take multiple arguments

91.0.0

Note

The public instance of VulnerableCode is running version 40.0.0 by now which got API v1 removed and exclusively uses API v3. This is why ORT's advisor for VulnerableCode now uses API v3 by default. Users who still run on an older version of VulnerableCode on-premise need to manually configure ORT's advisor for VulnerableCode to use API v1.

What's Changed

🛠 Breaking Changes

• 02e4a2d chore(license-fact-providers)!: Do not use "Provider" in the plugin ID
• d67da13 refactor(model)!: Use a more speaking name for DirLicenseFactProvider
• 8fe0b5b refactor(vulnerable-code)!: Use API v3 by default

🐞 Bug Fixes

• f405b39 commands: Support listing license-fact-provider plugin types
• 8e9ba4c vulnerable-code: Normalize also the API v1 URL
• 4cbd614 Support associating LicenseRef exceptions to licenses

🎉 New Features

• b9749a1 common-utils: Add helper functions to ensure prefix / suffix strings
• 25bb428 freemarker: Enhance licensesNotInLicenseFiles()
• 68eed69 license-fact-provider: Add a LicenseTextCurationProvider
• d229841 model: Add DefaultLicenseTextCurationProvider to default config
• a34c3a7 model: Add a data class for license text curations
• b30d6ab vulnerable-code: Add support for API v3
• bb5e09d Prefer a single applicable license over NOASSERTION for association

⚡ Performance Enhancements

• d92b066 vulnerable-code: Only query advisories for PURLs that have results

✅ Tests

• cc39d4b license-fact-provider: Use a more speaking name for licenseDir
• 91f4e6a scancode: Rename a test class
• f133e55 scancode: Showcase a current failure in exception association

🐘 Build & ⚙️ CI

• 388347b clients: Add kfx codegen setup for VulnerableCode

📖 Documentation

• ac0803e ADOPTERS: Update Double Open's contact details and description
• 2a62bb4 advisor: Move the data sources links from client to advisor
• 89e08bc go: Document that test dependencies of projects are omitted
• ef6b699 license-fact-providers: Fixup a display name
• 0b01b87 license-fact-providers: Reword summaries
• 46282f4 scancode: Make a test name refer to the correct function
• 1ca1b36 vulnerable-code: Mention that API v1 is deprecated
• 444fa63 website: Fix the link to a renamed license texts provider

🔧 Chores

• 3deed82 commands: Fail for unknown plugin types
• 0549561 commands: List plugin descriptions
• 9713e92 spdx-expression: Adjust a private constant name
• 4fdbcd8 spdx-expression: Prefer the in operator for a Regex check
• 37f5795 vulnerable-code: Extract shared utilities
• b2b2e15 vulnerable-code: Log details about the throwable on error
• 740aec6 vulnerable-code: Remove a superfluous type specifier
• 25510ef vulnerable-code: Simplify test helper functions

🚀 Dependency Updates

• 5873bae docker: Upgrade Provenant to version 0.2.1
• ed02494 update at.yawk.lz4:lz4-java to v1.11.1
• 024f8f4 update docker/login-action action to v4.3.0
• 25fdd50 update docker/login-action action to v4.4.0
• 88aa662 update docker/metadata-action action to v6.2.0
• 2fd31c7 update docker/setup-buildx-action action to v4.2.0
• 4976a6d update github/codeql-action action to v4.36.3
• a790cf4 update graalvm/setup-graalvm action to v1.6.0
• 0367698 update jirarestclient to v7.0.2
• acbda51 update log4j2 monorepo to v2.26.1

🚜 Refactorings

• 5719d27 clients: Patch schema and add workarounds
• b637e5e license-fact-provider: Rename scanCodeLicenseTextDir
• 4c45d4f model: Factor out isMatchedBy()
• 15e1c11 model: Factor out matchesDisregardingVersion()
• 2fa0f2b spdx-expression: Factor out isException() for reuse
• 90ca2dd vulnerable-code: Create a VC instance only once per test
• dfe465a vulnerable-code: Extract some constants to a common location
• d2c90ab vulnerable-code: Prepare for multiple API versions

90.0.0

What's Changed

🛠 Breaking Changes

• b4ea79f feat(model)!: Support multiple license fact providers of the same type
• f15e509 refactor!: Move the ORT_CUSTOM_LICENSE_TEXTS_DIRNAME constant

🐞 Bug Fixes

• dabfe95 license-fact-provider: Avoid infinite recursive calls
• f5e6248 mise: Add ssh as a required tool from the host
• b89dfd6 scanoss: Handle licenses only SCANOSS knows about for snippets
• 7178b63 scanoss: Handle unparsable license names for snippets
• 531304d scanoss: Maintain NOASSERTION also for empty license findings

🎉 New Features

• df1f0f0 license-fact-provider: Return a set of texts per id
• e9c2b3d spdx: Make SpdxDocument serialization deterministic

✅ Tests

• 6d9b2e6 conan: Update expected results
• d821044 scanoss: Add some coverage for getLicenseFindings()
• 2e9ba11 scanoss: Add some coverage for getSnippetFindings()

📖 Documentation

• f014881 examples: Correct Apache-2.0 license spelling
• 1469697 provenant: Further improve class docs
• eccc4af scanner: Note that the Provenant integration is experimental

🔧 Chores

• 001b213 license-fact-provider: Clarify and fix semantics of licenseId
• add01e5 license-fact-provider: Use a more speaking name for licenseId
• 1d7d695 mise/flox: Add convenient ways to run Gradle tasks
• fb3d273 model: Illustrate defining multiple license fact providers
• dbc0268 model: Re-align the order of license fact providers
• bf54d57 scanoss: Remove license expression sorting from the model
• 0b12599 spdx: Drop sorting now handled by serialization converters
• cf8878e spdx: Introduce constants for NONE / NOASSERTION as expressions
• 3568dde website: Replace deprecated onBrokenMarkdownLinks

🚀 Dependency Updates

• c80b848 docker: Pin Corepack to version 0.34.7
• f9cad6b update actions/attest-build-provenance action to v4.1.1
• bb55a4a update actions/setup-java action to v5.4.0
• c04207c update aws-java-sdk-v2 monorepo to v2.46.20
• e017c97 update ch.qos.logback:logback-classic to v1.5.36
• 803fbb8 update ch.qos.logback:logback-classic to v1.5.37
• ec98593 update com.autonomousapps.build-health to v3.16.0
• ffb0db1 update com.scanoss:scanoss to v0.13.1
• cea6811 update dev.aga.gradle.version-catalog-generator to v4.2.1
• 6fcae3b update docker/build-push-action action to v7.3.0
• 41a020d update exposed to v1.3.1
• c6d6e8d update gradle to v9.6.1
• e22dbff update io.ktor:ktor-version-catalog to v3.5.1
• 35e959c update org.graalvm.buildtools:native-gradle-plugin to v1.1.3
• 39fd2b4 update org.metaeffekt.core:ae-security to v0.156.3
• f759873 update org.postgresql:postgresql to v42.7.12
• 3bfc39f update org.spdx:java-spdx-library to v2.0.4
• b8869c4 update org.spdx:spdx-v3jsonld-store to v1.0.5
• 02a264e update react monorepo to v19.2.7

🚜 Refactorings

• bb0b814 scanoss: Extract license mapping to a common function
• ca08e46 scanoss: Factor out a licenses variable

89.3.0

What's Changed

🐞 Bug Fixes

• bab80ca downloader: Use exit code 2 for non-fatal failures
• 5377fed flox: Make all script error output go to stderr
• 7f56917 vulnerable-code: Hard-code "VCIO_API_AGENT" as the User-Agent

🎉 New Features

• 24ed320 commands: Print a docs link when outputting rule violations
• a10f5bc flox: Add Provenant as a Nix flake
• a47b842 flox: Add a convenience script to run ORT commands
• 096ad4f flox: Add a convenience script to run all tests
• abc0eec osv: Enable matching purls with type="github"
• e06ee35 osv: Ensure the purl is valid before using it
• 9fe6942 Add mise configuration files

⚡ Performance Enhancements

• 76bec40 model: Introduce a lookup cache in DependencyGraphBuilder

✅ Tests

• a3216e3 bazel: Update expected results
• 9ff0122 python: Update expected results
• 8bac4b8 scanner: Assert copyrights for ScanCode and Provenant
• a3029bd scanner: Remove passing-on of the test tag
• 9a935af scanner: Support asserting copyright findings
• be7a441 vulnerable-code: Enable a test again that works now

🐘 Build & ⚙️ CI

• 0d578cd flox: Add environments for all VCS tools

📖 Documentation

• 7f83577 flox: Add a README to explain the idea of using Flox
• f517511 git: Explain why the repo launcher's version is used
• edda885 model: Add a note about threading constraints
• 20c37f1 scanner: Use passive voice in a code comment

🔧 Chores

• 5e9b718 commands: Remove the unused OPTION_GROUP_RULE
• 4443bf9 docker: Simplify Ruby installation
• 6501425 gradle-inspector: Associate two extensions with different type
• fd6f33e gradle-inspector: Move two functions into the class
• 618aa15 model: Rename a map property in DependencyGraphBuilder
• ce9007f scanoss: Align mapping functions for findings to return a Set
• 04ebd1b scanoss: Improve the name of createSnippetFindings()
• d17d6b1 vulnerable-code: Set the user agent already in the client
• b71cb23 Introduce constants for status codes

🚀 Dependency Updates

• 0b3a3dc docker: Upgrade Provenant to version 0.1.14
• c7e4d2b docker: Upgrade licensee to version 10.0.0
• e810a17 update actions/checkout action to v7
• ff3771d update aesecurity to v0.156.2
• 4a03063 update flox/install-flox-action action to v2.5.2
• 0082bc2 update flox/install-flox-action action to v2.5.3
• 6f8be5d update gradle to v9.6.0
• d77f530 update jsonschemavalidator to v3.0.5
• c3e6e56 update kotest to v6.2.1
• b594d78 update logback monorepo
• 1bb032f update mavenpublishplugin to v0.37.0
• 8336094 update sortdependenciesplugin to v0.19.0

🚜 Refactorings

• a17fb02 commands: Move option group constants to a companion object
• 1800943 osv: Factor out createRequest()
• 331c89a osv: Factor out createRequestForPurl()

89.2.0

What's Changed

🐞 Bug Fixes

• 915c289 scanoss: Treat full file matches initially as pending snippet matches

🎉 New Features

• cb4855b cli-helper: Allow inserting an .ort.yml file into analyzer result

🐘 Build & ⚙️ CI

• 2ab2005 gradle: Avoid using Project.getProperties
• 7358073 gradle: Avoid using Project objects in dependency notation
• 49177e2 gradle: Avoid using property delegates

📖 Documentation

• 1d18e0f analyzer: Clarify the message about duplicate projects / packages
• 11004e6 model: Improve DependencyGraph class docs wording

🔧 Chores

• c63f40c cli-test-launcher: Conveniently run all tests

🚀 Dependency Updates

• 44882a9 docker: Upgrade Provenant to version 0.1.13
• e23a7c5 update actions/setup-java action to v5.3.0
• e8753ac update aws-java-sdk-v2 monorepo to v2.46.13
• 84c3a05 update blackduckcommon to v68.0.2
• 55b5aaf update dependency prettier to v3.8.4
• 4c9a331 update graalvm/setup-graalvm action to v1.5.6

🚜 Refactorings

• 9ec07af model: Factor out RepositoryConfiguration.orEmpty()

89.1.1

What's Changed

🐞 Bug Fixes

• 1c277de gradle-inspector: Avoid failing on component lookups

✅ Tests

• 4caf580 providers: Use isolated ORT data directories

📖 Documentation

• ac22717 providers: Clarify that a path is relative to the repository root

🚀 Dependency Updates

• 03a2734 update aesecurity to v0.156.1
• ff4a3c5 update graalvm/setup-graalvm action to v1.5.5
• de8be2c update jetbrains/qodana-action action to v2026.1.3
• 2911ff1 update kfxplugin to v0.2.10
• 13341e9 update kotest to v6.2.0

💡 Other Changes

• 49d46da Revert "ci(qodana): Pin to the previous version"

89.1.0

What's Changed

🐞 Bug Fixes

• 4dc0c4a docker: Force the lockfile of cargo-credential-netrc to be used
• 2c4ff7a flox: Also forward environment variables for terminal coloring
• 6b1b1af gradle: Avoid model name classpath clashes with GradleInspector

🎉 New Features

• 0aa36af license-fact-plroviders: Allow to provide id-specific texts
• a92f0d4 spdx-document-file: Optionally create issues for unclear linkage

📖 Documentation

• 687fec2 flox: Add an example how to run ort requirements
• a162a3a gradle: Correct the path to the referenced GradleModel.kt file
• cc41621 gradle-model: Remove obsolete comments
• a0b1cad license-fact-providers: Align on "a" for consistency

🔧 Chores

• 1f4c553 license-fact-provider: Group abstract functions together
• df194f7 ort-utils: Add "COLORTERM" to the relevant variables to show
• 576a55c scripts: Make the shebang line stand out as a separate comment
• 968ebf0 spdx: Add a license header to the script to create test assets
• 4e7fb6d spdx-document-file: Move getLinkageForDependency() into class

🚀 Dependency Updates

• c54908c docker: Upgrade Provenant to version 0.1.12
• cff9590 update aesecurity to v0.156.0
• 9119123 update gradle/actions action to v6.2.0
• ff5979f update greenmail monorepo to v2.1.9
• a212a1a update hikari to v7.1.0
• 4c2b946 update umbrelladocs/action-linkspector action to v1.5.4

89.0.0

Note

This release starts to build ORT with Java 25, which means that also the implied default Java version that the Gradle(Inspector) and Sbt analyzer use changes from Java 21 to Java 25. Analyzed projects that do not support Java 25 yet need to start explicitly setting the javaVersion for these analyzers in the respective plugin's options.

What's Changed

🛠 Breaking Changes

• 5e28e80 build!: Upgrade to Java 25 to benefit from various optimizations
• f893ace build(gradle)!: Move script definitions to script-utils
• 26be2aa build(scripting)!: Rename the module to just "script" for shortness
• 571af2e refactor!: Rename the ort-config package configuration provider module

🐞 Bug Fixes

• 51f1773 detekt-rules: Correctly determine the root project
• ef3e806 flox: Pass on API keys / PAT variables to the isolated environment
• f7cbbe4 gradle-plugin: Fix-up the caching mechanism
• 5860fde reuse: Add correct licensing information for unoconv files
• dc84c9c scanner: Do not create file archives multiple times
• ffb6488 fa41f4a tycho: Use correct identifiers for mapped packages
• 6643d57 yarn2: Deal with version mismatches
• 365d278 yarn2: Handle dependencies with multiple versions

🎉 New Features

• 362ff86 bazel: Add variable parsing to StarlarkParser
• cbd1d5b gradle-model: Make the representation more memory efficient
• ec245f4 ort-config: Extract a generic GitPackageConfigurationProvider
• 4230e99 spdx-document-file: Imply static linkage for CONTAINS
• 59fa18f spdx-expression: Map "No Copyright" to NONE

✅ Tests

• 924507d cli: Use GradleInspector instead of Gradle in a test
• 2e75615 conan: Update expected results
• 446d287 evaluator: Combine the "access ORT result" with checkSyntax()
• af4b1bd evaluator: Get the OSADL rules only once
• c942f6c model: Add noticeFilenames to OrtConfigurationTest
• 65d27e8 osv: Update expected results
• a3b9cf4 provenant: Remove an enabled-condition
• c2538fa scanoss: Disable failing tests
• 6abd9e7 vulnerable-code: Use an API key if configured

🐘 Build & ⚙️ CI

• 2e06850 gradle: Configure and rerun updateDaemonJvm
• 8f52b97 github: Adjust permissions for reviewdog
• 8683c28 github: Always run Gradle with stacktrace logging
• 75f16de github: Forward secrets to environment variables

📖 Documentation

• 0252e0b evaluator: Improve OSADL rules documentation
• 711ce96 evaluator: Update the path to the OSADL rules example input file
• a86b3a1 scanoss: Fix a typo in a code comment

🔧 Chores

• b8ee6d1 bazel: Add variable parsing tests for Bazel
• 322e7bc bazel: Make StarlarkParser more verbose for MODULE.bazel issues
• 04fe4cc evaluator: Update the OSADL compatibility matrix to 2026-02-12
• bb35656 flox: Align on the schema version and default outputs
• 742aad2 gradle: Reorder tasks definition a bit
• 1cf618c gradle: Replace map with forEach
• 9d51987 gradle-inspector: Log some status around getting the tree model
• 32c9884 gradle-plugin: Move resolvePoms() out of the class
• 6f4b729 gradle-plugin: Trivially simplify obtaining all components
• 4bfbe0f gradle-plugin: Use a more speaking name for dep
• f6db6c2 spdx-document-file: Factor out removeDocumentRefPrefix()
• 49a5f23 test-utils: Remove the ineffective execution order config
• b69dd08 test-utils: Remove unused JunitXmlReporter extension
• 2b50fbc Clean up github-graphql remainders
• 5ec726d Fix package names that slipped through while the check was broken

🚀 Dependency Updates

• 8d3c24b cli: Limit funTest dependencies to the minimum of concrete plugins
• e6b90ee docker: Upgrade Provenant to version 0.1.8
• cbd7340 gradle: Move the Git plugin dependency to the only place needed
• 7d8eade update aws-java-sdk-v2 monorepo to v2.46.8
• 3de77fe update codecov/codecov-action action to v6.0.2
• a8d4874 update codecov/codecov-action action to v7
• bb924a2 update com.autonomousapps.build-health to v3.15.0
• 51c2034 update dependency @easyops-cn/docusaurus-search-local to v0.55.2
• 60436e6 update github/codeql-action action to v4.36.2
• b83a940 update gitsemverplugin to v0.19.1
• f44d413 update gitsemverplugin to v0.19.2
• bbd5628 update graalvmnativeimageplugin to v1.1.2
• 636f7ad update gradle/actions action to v6.1.1
• 7fac2d9 update jruby to v9.4.15.0
• 0cc6d2a update jsonschemavalidator to v3.0.4
• f71ee2b update okhttp monorepo to v5.4.0
• 8acb4ad update spring core to v7.0.8
• f25ba7c update umbrelladocs/action-linkspector action to v1.5.3

🚜 Refactorings

• 287844e gradle: Inline the code from gradle-model
• 405094c gradle-model: Introduce an OrtComponentIdentifier
• 393483a gradle-model: Rename OrtDependency to OrtComponent
• 20f0e14 gradle-plugin: Move a distinct() downwards in call tree
• 9909617 spdx-document-file: Use a map to find relationships

88.0.0

What's Changed

🛠 Breaking Changes

• 44bf368 refactor!: Rename a Gradle module to match the Git curation provider
• fe47add refactor(gradle)!: Split out authentication utilities to a new module
• e4379ef refactor(plugins)!: Rename description to summary
• db57349 refactor(spdx)!: Split out expression-related code to a new Gradle module

🐞 Bug Fixes

• 4cc2fbe maven: Use unlimited JAXP XML processing with Java >= 24
• 2adf5e4 model: Adhere to omitExcluded for projects in getDependencies()
• 14c0f5c ort-utils: Read the request body before responding in a test
• 33f9795 ort-utils: Set the body size to -1 when not sending any body in tests

🎉 New Features

• 1d8bd43 gradle: Support HTTP header authentication for repositories
• 4632b4c ort-config: Extract a generic GitPackageCurationProvider
• d926869 plugins: Add description property to PluginDescriptor

🐘 Build & ⚙️ CI

• 5392863 cli-test-launcher: Do not tap into the file-system to get funTests
• deabfba gradle: Apply dependency-analysis as a settings plugin
• 320dd08 gradle: Apply the sort-dependencies plugin
• 4212953 gradle: Do not use libs in convention plugins
• 18fdf4e gradle: Enable more dependency analysis rules
• b219898 gradle: Remove all unused dependencies
• fae8ac1 gradle: Use correct configurations for dependencies
• 5ddb211 model: Reduce to runtimeOnly dependencies where possible
• 3f7c081 static-analysis: Add a check for build health
• e0694bc static-analysis: Include checking for sorted dependencies

📖 Documentation

• f3266f3 gradle: Add links to configuration roles for reference
• 40ef461 gradle: Document why a dependency analysis rule is disabled
• 287efcd gradle: Remove some weird chars from a because string
• 988cc27 model: Add a missing "the"
• c39bb92 model: Further clarify the term provenance in two cases
• 48a5b0e plugins: Document how class docs are used as plugin descriptions
• 9530a42 plugins: Trivially improve the plugin docs
• 93171d3 skills: Start adding code-review skills for Copilot
• 6e3f0ac website: Show the plugin descriptions
• 4673835 Move OrtProject package manager docs to the plugin

🔧 Chores

• 6e6d13e gradle: Remove inconsistent test fixtures comments
• 019abdf maven: Log Tycho stderr output for debugging
• 695cc6d model: Improve the construction of the used patterns
• 68b931a ort-utils: Let the system pick an ephemeral port for testing
• dd1085c ort-utils: Use a ConcurrentHashMap for requests in tests
• 25df745 spdx-expression: Make all mapping types explicit for clarity
• 71d5687 Give utility files more fitting names

🚀 Dependency Updates

• b8f4b68 update actions/checkout action to v6.0.3
• 8ca6af1 update aws-java-sdk-v2 monorepo to v2.46.0
• a57068a update aws-java-sdk-v2 monorepo to v2.46.3
• f0d9382 update buildconfigplugin to v6.0.10
• 17b080f update ch.qos.logback:logback-classic to v1.5.34
• 9fac900 update com.autonomousapps.build-health to v3.14.1
• f98024b update docusaurus monorepo to v3.10.1
• b1b82c2 update flox/install-flox-action action to v2.5.1
• d687fae update github/codeql-action action to v4.36.1
• 6cc8e02 update graalvm/setup-graalvm action to v1.5.4
• 5672f01 update io.mockk:mockk to v1.14.11
• bfcc3b5 update jackson monorepo to v2.22.0
• 910e103 update jgit to v7.7.0.202606012155-r
• 11569d5 update net.sf.saxon:saxon-he to v13
• c3c3589 update umbrelladocs/action-linkspector action to v1.5.2

🚜 Refactorings

• a254b38 gradle-plugin: Drop a when in favor of early returns
• 555bc12 gradle-plugin: Drop another when in favor of early returns
• e3dcbad gradle-plugin: Factor out getPomFile()
• 5c87913 gradle-plugin: Factor out toOrtDependency()
• 32a3f6f gradle-plugin: Inline selectedComponent
• c2ccd72 spdx: Migrate from Jackson to KxS
• 402b766 spdx-expression: Avoid Jackson for mapping deserialization

💡 Other Changes

• 212a470 style(gradle): Sort dependencies automatically
• 4401b96 style(plugins): Consistently use single-line docs where possible