[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.ossreviewtoolkit:model (source)	94.1.0 → 95.0.0

---

Release Notes

oss-review-toolkit/ort (org.ossreviewtoolkit:model)

v95.0.0

Compare Source

What's Changed

🛠 Breaking Changes

• 926a76f chore(spdx-expression)!: Drop the unused mapSimple and mapDeprecated

🐞 Bug Fixes

• 8c3d5e7 github-action: Coerce null jobs to the empty list
• 0c8ad63 github-action: Support multiple workflows with same names
• f08bcbc web-app: Keep the dependency graph's package details in view
• ced7443 web-app: Score CVSS v4.0 vectors in the severity radar
• 4fb16ee web-app: Show the comment of a resolution next to its reason
• 65fe685 web-app-template: Do not say "Lines" if only a single line matched

🎉 New Features

• f9ebbbc cli: Add a toggle for ambiguous license mappings
• ad616c9 cli: Also handle the simple mapping via enableRiskyMappings
• 8c9665f gradle-inspector: Handle autolinked modules

✅ Tests

• 23b4655 conan: Update expected results
• 6d22cff python: Update expected results
• 0716541 python: Update expected results
• ecd6689 spdx-expression: Add a test for the deprecated license mapping
• 5dcd4f2 spdx-expression: Group simple mapping tests in a single spec
• 5ef95fb spdx-expression: Group tests by corresponding function or property
• f073c37 spdx-expression: Make a test case run on the combined mapping
• c4bf36b spdx-expression: Make all test operate on expression mapping only
• 09fd4cb spdx-expression: Make all tests operate on the raw mapping only
• b114a40 spdx-expression: Run a couple of test on the entire mapping
• 2499d26 spdx-expression: Simplify a test case
• 0cb4b21 utils: Align test and variable names on customLicenseMapping

📖 Documentation

• 59c8e0f spdx-expression: Fix a broken KDoc reference

🔧 Chores

• 2faa46e Analyzer: Expose checking for ignored paths

🚀 Dependency Updates

• 4e0ecfb replace attest-build-provenance action with attest v4.2.2
• dfd1f1c update at.yawk.lz4:lz4-java to v1.12.0
• f434d36 update ch.qos.logback:logback-classic to v1.6.4
• e8ff5f3 update com.github.gmazzo.buildconfig to v6.1.2
• 1ba3441 update com.google.api.grpc:proto-google-common-protos to v2.77.0
• e11a653 update com.squareup.wire to v7.0.4
• 49923f0 update github/codeql-action action to v4.38.2
• 6c1a6fb update gradle to v9.8.0
• 81eac9a update gradle/actions action to v6.4.0
• 72d4bd9 update jdx/mise-action action to v5
• 695fd23 update jetbrains/qodana-action action to v2026.2.2
• 48f5b31 update org.apache.tika:tika-core to v4.1.0
• 277c1d5 update org.metaeffekt.core:ae-security to v0.157.2
• bef2a88 update wire to v7.1.0

🚜 Refactorings

• aa0239d fossid: Restructure mapLicense()
• 4ea2396 spdx-expression: Factor out readLicenseMappingResource()
• b964c70 spdx-expression: Generalize readLicenseMappingResource()
• 483dbb5 spdx-expression: Make use of readLicenseMappingResource()
• 3ece305 spdx-expression: Rename classes from *Mapping to *Mapper
• 4b804ae spdx-expression: Split out ambiguous declared license mappings
• fbf692c spdx-expression: Split out ambiguous simple license mapping
• 442e446 spdx-expression: Turn SpdxDeclaredLicenseMapper into a class
• 5ab219f spdx-expression: Turn SpdxSimpleLicenseMapper into a class
• a11d6ca spdx-expression: Use a better name for mapping

v94.2.0

Compare Source

What's Changed

🐞 Bug Fixes

• e912a17 Gradle: Filter out self-dependencies
• af23e80 cargo: Do not crash if cargo is not installed
• aaf2e7c clearly-defined: Do not JSON-decode in case of server-side errors
• 720574c github-action: Do not crash if abom is not installed
• 5b8a159 gradle-inspector: Filter out self-dependencies
• 3501d42 schemas: Validate the repository license choice entries

🎉 New Features

• 35b4bdc clearly-defined: Fall back from batch to individual requests
• 0e14faf spdx-expression: Allow a comment on a license choice
• c2851dd web-app: Show the comment explaining a license choice

✅ Tests

• 4b13012 clearly-defined: Extend ignorance to any server-side error
• 87eb13a clearly-defined: Fix the non-working approach for skipping tests
• 0dbf749 conan: Update expected results
• fb899ce fossid: Group the test cases by the function they target
• 3bced1a fossid: Improve findings assertions
• 3a798ae fossid: Improve inputs for detected license mapping tests
• 3c09882 fossid: Make issues assertions a tad more compact
• a03ed5c fossid: Make more obvious when detected license mapping is tested
• 9f8f09f fossid: Minimize the input of a test case
• b9c0b6c fossid: Use a better name for FossIdLicenseMappingTest.kt

📖 Documentation

• c214d6c ort-yml: Document the comment on a license choice
• b3a5317 Fix two more instances of a typo

🔧 Chores

• bb4cb01 ClearlyDefined: Move a TODO to a more appropriate place
• f87596b clearly-defined: Consistently handle exceptions from service
• 7537fdd clearly-defined: Use the isServerSideError extension property
• 4b7c06f gitattributes: Remove an obsolete entry
• dd6bf18 open-source-insights: Use a more speaking name for it
• e764e5c scanner: Simplify code for getting a single definition
• 7174ee5 utils: Move a property to its only use
• 87cd4e0 web-app: Add license choice comments to the sample report

🚀 Dependency Updates

• 3bd025d update aws-java-sdk-v2 monorepo to v2.55.1
• 44f0a33 update com.fasterxml.jackson:jackson-bom to v2.22.3
• 660f276 update com.github.gmazzo.buildconfig to v6.1.1
• 8ad1adc update com.icegreen:greenmail to v2.1.14
• 6672108 update github/codeql-action action to v4.38.1
• 0f6c60f update io.github.hfhbd.kfx to v0.2.17
• 87c439f update org.graalvm.buildtools:native-gradle-plugin to v1.1.14
• 9cf2cf9 update org.slf4j:slf4j-api to v2.0.20
• 2ae66f5 update org.spdx:spdx-v3jsonld-store to v1.0.6

💡 Other Changes

• 118e906 style(clearly-defined): Inline a variable

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.