79.1.0

What's Changed

🐞 Bug Fixes

• 010e0b2 conan: Include header-only libraries in the dependency graph
• 7b1f894 fossid: Avoid parsing plain text comments as ORT JSON
• 23ffb5b gradle: Recognize platform dependencies as metadata-only
• c1d3556 gradle: Replace usages of deprecated methods in Groovy code
• 4bbbd2b gradle-inspector: Recognize POM artifacts as metadata-only
• 38fba04 scanner: Do not store duplicate scan results
• b0f7717 scanner: Fall back to GET from HEAD requests in more cases
• 2b6b390 scanner: Prevent an exception due to duplicate results
• c3d17a2 scanner: Regard HTTP_MOVED_TEMP as a successful provenance check
• f10091c schemas: Add missing pathIncludeReason

🎉 New Features

• 815a704 RepositoryConfiguration: Add a model for scope includes
• 7c28392 analyzer: Pass the includes as a parameter to resolveDependencies
• c30c8ed gradle: Add basic support for KMP dependencies
• 8737b8f gradle: Capture attributes of dependency variants
• 4f7a99f model: Apply the scope includes to the DependencyGraphConverter
• 0590eeb model: Apply the scope includes to the OrtResult
• 991d476 reporter: Take in account the scope includes

✅ Tests

• 1bdb5b6 gradle: Remove disabled tests for ancient Gradle versions
• 14c74ee osv: Update expected results
• 90c98a0 pnpm: Ensure to use a consistent PNPM version
• 6403771 postgres: Fix running on Docker 29.0.0
• 95ce602 Use the more generic Testcontainers instead of otj-pg-embedded

🐘 Build & ⚙️ CI

• c1b0669 renovate: Switch to the pinGitHubActionDigestsToSemver preset

📖 Documentation

• 338946b gradle-inspector: Add a missing "the" to code comments

🔧 Chores

• 38a41d6 model: move a condition to filterExcludedPackages
• 474a8d6 website: Remove the node engine, which is advisory only
• 9f9b116 website: Run npm audit fix to address vulnerabilities
• 3b6b2ae Add more early returns for cheap checks when comparing dependencies

🚀 Dependency Updates

• 57e30c9 pin dependencies
• 932c889 update actions/attest-build-provenance action to v3.2.0
• 677df9b update actions/checkout action to v6.0.2
• d40a669 update actions/deploy-pages action to v4.0.5
• 6f4d098 update actions/setup-java action to v5.2.0
• 7d39534 update actions/setup-node action to v6.2.0
• ab85d39 update ch.qos.logback:logback-classic to v1.5.31
• 8cc6dcc update ch.qos.logback:logback-classic to v1.5.32
• c1d86f0 update codecov/codecov-action action to v5.5.2
• 113a3d8 update crazy-max/ghaction-upx action to v3.2.0
• aa4c007 update docker/build-push-action action to v6.19.2
• 4818fa1 update docker/build-push-action digest to 10e90e3
• 70c56b4 update docker/login-action action to v3.7.0
• ba8ea68 update docker/metadata-action action to v5.10.0
• f4f0539 update docker/setup-buildx-action action to v3.12.0
• 59256bc update flox/install-flox-action action to v2.3.0
• fc4b1dd update github/codeql-action action to v4.32.2
• e4421e3 update github/codeql-action action to v4.32.3
• 4c950b0 update graalvm/setup-graalvm action to v1.4.5
• f250cb3 update gradle/actions action to v5.0.1
• 404bebb update ksp monorepo to v2.3.6
• 9cc9e63 update mavenresolver to v1.9.26
• 42fe7c4 update org.jetbrains.gradle.plugin.idea-ext to v1.4.1
• 09067c6 update org.springframework:spring-core to v7.0.4
• 617f238 update org.springframework:spring-core to v7.0.5
• 4ed8f84 update umbrelladocs/action-linkspector action to v1.4.0
• b5a84e9 update wagoid/commitlint-github-action action to v6.2.1

🚜 Refactorings

• cd7ae77 scanner: Move result creation out of loop

💡 Other Changes

• a484075 Revert "fix(gradle-plugin): Ignore BOM dependencies"
• f2a9c76 style(gradle): Reduce indentation in tests

79.0.0

What's Changed

🛠 Breaking Changes

• 6453a52 chore(model)!: Use the central function for includes/excludes evaluation

🎉 New Features

• b57b623 model: Support Ivy's "Sub Revision Matcher" syntax explicitly
• e28b6ec spring: Add basic version range support to the curation provider

✅ Tests

• 305488d conan: Update expected results
• 9846852 model: Add a direct test for Ivy "Sub Revision Matcher" syntax
• d7c7e07 osv: Update expected results
• dd71d2e pub: Update expected results

🐘 Build & ⚙️ CI

• 383b496 gradle: Do not publish application modules
• c0d1175 gradle: Enforce the Kotlin version only for application modules
• ed2500a gradle: Use the Kotlin BOM to align kotlin-reflect versions
• 2951d4d github: Downgrade Flox to 1.8.4
• 41418b6 github: Use CodeQL nightly for Kotlin 2.3.10 support
• 7bfdcbf Add a job to test the Maven publication

📖 Documentation

• 033561a spring: Give a test a more specific name
• f191d7a website: Fix a code snippet to say includes

🔧 Chores

• 434514d PackageManager: Evaluate the includes/excludes in a central function
• a522606 fossid-webapp: Use the function for includes/excludes evaluation

🚀 Dependency Updates

• 29c78e8 flox: Upgrade environments to ScanCode 32.5.0
• 3956117 update actions/checkout digest to de0fac2
• fe50797 update aws-java-sdk-v2 monorepo to v2.41.27
• 8d7541c update ch.qos.logback:logback-classic to v1.5.27
• 646f995 update ch.qos.logback:logback-classic to v1.5.28
• 451a2d7 update ch.qos.logback:logback-classic to v1.5.29
• a2eb8bc update de.undercouch.download to v5.7.0
• ed588cd update docker/build-push-action digest to 601a80b
• fe628a3 update docker/build-push-action digest to ee4ca42
• 4525c9f update github/codeql-action digest to 45cbd0c
• b91a726 update gradle to v9.3.1
• ff98bcd update io.github.irgaly.kottage:kottage to v1.11.0
• 08fe95d update kotest to v6.1.3
• 9f8f6f0 update kotlin monorepo to v2.3.10
• f34ee8b update org.cyclonedx:cyclonedx-core-java to v12.1.0
• 9f01a73 update org.glassfish.jersey.core:jersey-common to v4.0.2
• c0ca15c update org.postgresql:postgresql to v42.7.10

🚜 Refactorings

• 9c4adad model: Rename isVersionRange() to hasIvyVersionRange()
• afa9bc7 model: Simplify the code to get version ranges

💡 Other Changes

• 966e764 Revert "fix(docker): Copy only cargo directory instead of full Rust installation"
• c88336d style(model): Add a blank line after the header

78.0.0

What's Changed

🛠 Breaking Changes

• 021a3ff refactor(plugins)!: Make option parsing functions extension functions
• 43bd6d5 refactor(plugins)!: Pass the plugin option to the parsing functions

🐞 Bug Fixes

• 1bb26ab conan: Filter packages by APPLICATION and BUILD_SCRIPTS types
• 8e9156e docker: Add cache mount for nvm during Node.js build
• be3d891 docker: Add cache/tmpfs mounts to base stage to reduce image size
• 28863b1 docker: Build askalono in separate stage to reduce image size
• d80b3fc docker: Build cargo-credential-netrc in separate stage
• d7f1669 docker: Copy only cargo directory instead of full Rust installation
• ab8e3e8 docker: Mount /tmp and /home as tmpfs during ort requirements
• 58bd033 docker: Move recursive chmod into Android build stage
• 7349036 docker: Optimize PHP installation to reduce image size
• 586dcee docker: Prune .NET installation to keep only runtime
• 222c28c docker: Prune Swift installation to keep only package manager
• ffc3c84 docker: Remove Python pycache directories from image
• b341987 downloader: Support (Git) working trees without a remote

🎉 New Features

• 389d9bd ort-utils: Log stacktraces with a logger
• 3d7f14f plugins: Add support for enum and enum list options
• 7bd1406 web-app-template: Show scan result details for a package

✅ Tests

• 34e475b conan: Update expected results
• 0a2bf99 plugins: Add tests for all plugin option parsing functions

🐘 Build & ⚙️ CI

• d073d5a renovate: Merge two NPM related configs
• 360b9cf renovate: Pin NPM dependenies

📖 Documentation

• b388620 plugins: Add an example for plugin option aliases
• de109d6 plugins: Update a code example
• f89adfe Add python-ort reference in documentation

🔧 Chores

• 2f9a604 buildSrc: Remove an unnecessary default argument

🚀 Dependency Updates

• 17b25b9 docker: Upgrade to ScanCode 32.5.0
• 0bd79c8 update ch.qos.logback:logback-classic to v1.5.26
• fe9fb4a update detektplugin to v2.0.0-alpha.2
• a00123f update docker/login-action digest to c94ce9f
• f1b0670 update exposed to v1
• 0c4924a update flox/install-flox-action digest to 9428713
• 74caab4 update github/codeql-action digest to 19b2f06
• c17c5a7 update github/codeql-action digest to b20883b
• d131de5 update gradle/actions digest to f29f5a9
• c91c2f9 update io.mockk:mockk to v1.14.9
• 215e7c0 update kotest to v6.1.1
• ac905ff update kotest to v6.1.2
• bbb1e9c update ksp monorepo to v2.3.5
• 3466305 update org.glassfish.jersey.core:jersey-common to v4.0.1
• c7aa177 update org.jetbrains.gradle.plugin.idea-ext to v1.4

🚜 Refactorings

• ec79e5e cyclonedx: Make use of enum options
• c2c5f43 evaluated-model: Use enum for the output formats config option
• c3f2749 fossid: Use enums for config options
• 0d1876f python: Use an enum for the operating system config option
• 3382ec6 spdx: Use enums for config options
• 184acd4 web-app-template: Move and improve date conversion function
• de52240 web-app-template: Move and rename link render function

💡 Other Changes

• d77e356 style(detekt): Add a blank line between when-conditions
• b0670d0 style(detekt): Do not use KDoc inside a 'block'

77.0.0

What's Changed

🛠 Breaking Changes

• 4019fdd feat(evaluated-model)!: Include metadata for all tool runs

🐞 Bug Fixes

• d198bcf detekt-rules: Make auto-correct work again
• 8c8052b plugins: Filter empty strings when parsing string list options
• 49d58e6 web-app-template: Fix showing the VCS info for packages
• e1006f2 web-app-template: Remove render from getColumnSearchProps
• 3a0f6b3 web-app-template: Rename 'Excludes' in AboutModal
• e135465 web-app-template: Restore Tag styling
• 0083c58 web-app-template: Return 0 as index from getLicenseIndexByName

🎉 New Features

• 4d74aa5 evaluated-model: Add a property for the package labels
• 0357a3a evaluator: Add Environment to Evaluator
• 79fa3c9 web-app-template: Add links to license tables
• 4743807 web-app-template: Add package configurations to models
• d305176 web-app-template: Display package labels from curations
• 206e2bc web-app-template: Show curations for a package
• 451566c web-app-template: Show metadata in AboutModal
• df4a0d1 web-app-template: Show package configs for a package
• ccfc7e7 web-app-template: Show package configs in AboutModel
• d56e8c5 web-app-template: Show package curation in AboutModel
• d06a5bc web-app-template: Show/hide curations column
• 0a82524 web-app-template: Show/hide package configs column
• bbb50a3 web-app-template: Add OrtResult.getPackageById()

✅ Tests

• 3f7d457 advisors: Temporarily disable a test
• c213d12 common-utils: Switch from invocations to property testing
• 77d6048 reporters: Re-align environment objects in test data
• 686d3b1 web-app: Adjust the expected size
• e583a6f web-app: Adjust the expected size

🐘 Build & ⚙️ CI

• 06c8819 gradle: Migrate from Dokkatoo to Dokka for documentation generation
• 2a7439e gradle: Remove the explicit "sourcesJar" task definition

📖 Documentation

• 6792a80 detekt: Update URLs in comments of the configuration
• d392f68 evaluated-model: Fix-up and improve comments

🔧 Chores

• 62d1c99 common-utils: Use Kotlin's Any instead of Java's Object
• 70957fc detekt-rules: Add language injection markers in test code
• a6cdd72 detekt-rules: Omit the file path from the finding's message
• 74a4606 gradle-plugin: Bump the minimum Kotlin version to 1.9
• 3e9963d model: Add an explicit return type to a function expression
• 4530740 web-app-template: Address ESLint issues
• 271fc21 web-app-template: Fix linter issue
• 6cb787b web-app-template: Implement RepositoryConfiguration
• c963831 web-app-template: Increase Drawer size to 70% / min 1000px
• 1d1678c web-app-template: Lift ResultTable state to AppPage
• 6422347 web-app-template: Rename OrtResult YAML functions
• 7127e67 web-app-template: Replace deprecated APIs
• ba6807e web-app-template: Replace deprecated properties
• 697e9ba web-app-template: Update Statistics
• d496493 web-app-template: Update index.html
• 265359f web-app-template: Update test index.html
• 2f69228 web-app-template: Update test index.html
• ca16508 web-app-template: Use indexes for curations
• 4513686 Align visibility of serializers with class visibility

🚀 Dependency Updates

• 8621182 gradle: Upgrade to Detekt 2
• 81e7bda gradle: Upgrade to Gradle version 9.3
• 643ccbc web-app-template: Update versions of dependencies
• cf20c0c update actions/setup-java digest to be666c2
• 015fb13 update at.yawk.lz4:lz4-java to v1.10.3
• b44be77 update aws-java-sdk-v2 monorepo to v2.41.12
• 84e2b2f update ch.qos.logback:logback-classic to v1.5.25
• 01e2c65 update com.fasterxml.jackson:jackson-bom to v2.21.0
• 2ba11e4 update com.github.ajalt.clikt:clikt to v5.1.0
• 3dd5330 update com.vanniktech:gradle-maven-publish-plugin to v0.36.0
• 5618680 update dependency prettier to v3.8.1
• 091322f update flox/install-flox-action digest to e3e10c1
• 60ab46a update kotest to v6.1.0
• 52582cb update kotlin monorepo to v2.3.0
• 2a03509 update kotlinxserialization to v1.10.0
• f1b5baa update org.cyclonedx:cyclonedx-core-java to v12
• 1c51723 update org.graalvm.buildtools:native-gradle-plugin to v0.11.4
• 0fcb9d5 update org.metaeffekt.core:ae-security to v0.151.0
• 7e77709 update org.metaeffekt.core:ae-security to v0.152.0
• e89dd32 update org.postgresql:postgresql to v42.7.9
• 9e24c07 update org.springframework:spring-core to v7.0.3

💡 Other Changes

• 5692fab Revert "build(gradle): Add a "detektAll" convenience task"
• cfa2874 style(detekt): Adjust config / code so that the code base passes checks

76.0.0

What's Changed

🛠 Breaking Changes

• 19c7262 feat(evaluated-model)!: Include entire package curations
• 8d924fb refactor(evaluated-model)!: Use indexing and referencing for curations

🐞 Bug Fixes

• 8c7bc8c cli: Reduce the non-interactive terminal width for Mordant
• 0bacbb2 fossid-webapp: Add missing license category
• 63b0dd2 git: Checkout with force to be on the safe side
• 84ed217 node: Make passing --use-system-ca conditional
• 428f4ef ort-utils: Use the default ORT OkHttp client for Java bootstrapping

🎉 New Features

• 7953a2e evaluated-model: Add package configs to each package
• f666a70 gleam: Fail hard in case the lockfile is missing an entry
• 9c059a8 plugins: Simplify code generation for parsing plugin options
• 5857495 utils: Cache the result of the disco service
• 3719714 yarn2: Also conditionally use system certificates

✅ Tests

• b1d6a9a conan: Update expected results
• a387268 evaluated-model: Add package configs to test input
• 4dc5bf3 ort-utils: Avoid polluting the main HTTP cache
• a1d3d91 python: Update expected results

🐘 Build & ⚙️ CI

• 32b9aea subversion: Substitute the vulnerable lz4-java dependency

📖 Documentation

• 6925db2 bundler: Use one-line KDoc syntax for compact property docs
• c59b261 tekton: Replace deprecated Tekton hub links

🔧 Chores

• 0857d71 bundler: Explicitly convert Gem::Version to a string
• dc02550 downloader: Prefer the in operator over contains()
• 0c78949 gleam: Make use of orEmpty()
• 6c19daf gleam: Remove the unnecessary wrapping via ManifestPackageInfo
• 05fca1e gleam: Turn toIdentifier() into an expression
• cdac3fc model: Make isVersionRange() public
• bd141b8 plugins: Make PluginOptionType know their type names

🚀 Dependency Updates

• f375d09 docker: Upgrade Pip to version 25.3.0
• e363b36 update actions/setup-node digest to 6044e13
• a7211c0 update aws-java-sdk-v2 monorepo to v2.41.7
• d45399b update com.scanoss:scanoss to v0.12.1
• e41416b update github/codeql-action digest to cdefb33

🚜 Refactorings

• ffc37f7 node: Override run() that takes environment
• cbeb299 utils: Slightly simplify an expression

💡 Other Changes

• 15bf783 Revert "feat(utils): Cache the result of the disco service"

75.0.0

What's Changed

🛠 Breaking Changes

• e7fabb0 feat(plugin)!: Set the retention of plugin annotations to SOURCE

🎉 New Features

• e346865 docker: Add Gleam programming language to the full image
• 4f61c3a gleam: Run 'gleam deps download' when no lockfile exists

✅ Tests

• 45a5854 gleam: Use HTTPS URL for git dependency in test fixture

🐘 Build & ⚙️ CI

• e36da82 github: Consistently pin Ubuntu to version 24.04
• 2c7281d github: Do not fail Docker X86 if the ARM64 build fails
• b048254 github: Install Askalono from source for the ARM64 Docker image
• 6fefdf5 github: Simplify an arch condition
• 6f19105 linkspector: Ignore a valid URL that is reported as broken
• 6fe0379 linkspector: Improve the pattern for ignoring localhost links

📖 Documentation

• c35c831 README: Update the copyright year range
• 198c6f7 website: Fix handling of plugin option default values
• e11ee58 website: Show aliases for plugin options

🔧 Chores

• 4078055 linkspector: Ignore links to localhost
• 2f22d89 mailmap: Update Martin's email address
• ed3fd97 plugins: Improve formatting of aliases
• 9337ba2 plugins: Improve formatting of fallback values
• 9f56f01 stack: Fix broken links in a test project

🚀 Dependency Updates

• 7f2dd59 update aws-java-sdk-v2 monorepo to v2.41.0
• 5b15950 update ch.qos.logback:logback-classic to v1.5.24
• ad8327e update com.github.jmongard.git-semver-plugin to v0.18.0
• 29d66a3 update graalvm/setup-graalvm digest to 54b4f5a

🚜 Refactorings

• 72b7a10 gleam: Remove manual non-transitive dependency resolution
• 308b337 gleam: Remove redundant vcsProcessed assignments
• 681179a gleam: Simplify package info class hierarchy
• fb7244f gleam: Use / operator instead of resolve() for paths

74.1.0

What's Changed

🐞 Bug Fixes

• 6ec822f pub: Correct the command returned for ort requirements
• 1ae59c2 requirements: Correctly categorize manually instantiated classes

🎉 New Features

• d20aabc gleam: Handle scope excludes

✅ Tests

• 1927b63 gleam: Remove the "gleam-" prefix from test projects
• ae069a2 gleam: Slightly improve test names
• 49b528f gleam: Use a more speaking name for the "gleam" project
• 05deaf6 ort-utils: Make JavaBootstrapperTest a "funTest"
• 53192c7 python: Update expected results

🐘 Build & ⚙️ CI

• 5723455 gradle: Also set the version for the buildSrc project
• 5d2beb5 gradle: Simplify accessing the version catalog from buildSrc

📖 Documentation

• bb6420f NOTICE: Fix a typo
• fd792c7 cocoapods: Fix a typo
• 84a5e66 fossid: Fix a typo
• 38fd362 gleam: Clarify the reason for an existing fallback
• f4e43e6 website: Fix a typo

🔧 Chores

• a7a3fb4 cli: Use unlimited width for non-interactive terminals
• 70ed38e examples: Add a missing dot
• dcfff3d examples: Drop redundant curly braces
• d438411 gleam: Make getManifestPackageInfoOrDefault() an expression
• 6874eba gleam: Use a more speaking name for tryLock()
• f0e9b9c package-managers: Omit the named with argument for serializers
• 9d2558a plugins: Address an "upper bound violated" inspection hint
• cde9741 requirements: Name a lambda parameter for clarity
• fbd955e requirements: Remove an unneeded when case
• 069fc27 scanner: Avoid passing the default value of path
• 5498486 Reduce the visibility of some custom serializers to the minimum

🚀 Dependency Updates

• ec16ef2 update ch.qos.logback:logback-classic to v1.5.23
• 1637447 update com.github.gmazzo.buildconfig to v6.0.7
• cacc2af update dev.aga.gradle.version-catalog-generator to v4
• 882e906 update docker/setup-buildx-action digest to 8d2750c
• af38520 update jetbrains/qodana-action action to v2025.3.1
• ae1c15e update org.metaeffekt.core:ae-security to v0.150.1
• 1e9a518 update org.metaeffekt.core:ae-security to v0.150.2

🚜 Refactorings

• f57737c gleam: Use a custom deserializer for dependencies
• 5ea4d53 requirements: Make category assignment more explicit

74.0.0

What's Changed

🛠 Breaking Changes

• f0601e3 refactor!: Use EnumSet for LicenseSource

🐞 Bug Fixes

• 474b1b4 docker: Add libicu-dev dependency for ARM Python builds
• 7ddcac2 docker: Install licensedcode-data on ARM for license text extraction
• 3aaff7f docker: Set HOME and USER env vars after switching to user
• 19a4232 docker: Update scancode-toolkit requirements URL to aboutcode-org
• 51f38fa gleam: Correctly detect path dependencies outside project directory
• cce9cba gleam: Create fresh Gleam instance for each test
• 50e5910 gleam: Increase severity of an issue
• fcd57c7 gleam: Use Gleam type for path dependencies and track project dirs
• 523c37e utils: Handle SCP-style URLs with paths starting with tilde

🎉 New Features

• bbfa6e2 common-utils: Add an enumSetOfNotNull() convenience function
• 393130e common-utils: Add the EnumSet.intersect() function
• 7b92ab0 docker: Build multi-arch images with native ARM/X86 runners
• 32d6aad downloader: Handle nested archive format for Hex packages
• 27a0d2b gleam: Add package manager plugin for Gleam
• c7d42e9 model: Add Hex and OTP PURL types for Gleam support

✅ Tests

• 1cd7eab clearly-defined: Revert an accidental change
• 25a5ab9 common-utils: Add some more tests for enumSetOf()

📖 Documentation

• 116f4e7 gleam: Improve code comments a bit
• b2428f8 Add Gleam to supported package managers list

🔧 Chores

• 0f1563f analyzer: Register Gleam package manager plugin
• b04db80 common-utils: Improve the enumSetOf() docs and signature
• 326904a gleam: Drop an unnecessary this
• 7ebcaaf gleam: Extract a constant for the project type
• f2c209c gleam: Extract remaining source types to constants
• 4b9d6af gleam: Improve finding the hompage URL
• f28b2ea gleam: Inline hexClient
• 9529fea gleam: Make GleamProjectContext a plain class
• c74df42 gleam: Make several internal functions private
• 91eca97 gleam: Make some constructor members private
• a13b625 gleam: Move Hex data model classes to a separate file
• 45b35a5 gleam: Move GleamProjectContext to its own file
• 9651b73 gleam: Move functions closer to their only users
• 55b171b gleam: Remove a redundant let call
• c4b2854 gleam: Remove an unused variable from GleamProjectContext
• 345020d gleam: Scope HOMEPAGE_KEYS to the only class that uses it
• bfc5ab3 gleam: Simplify a few property overrides
• e14e1e5 gleam: Sort top-level functions alphabetically
• d777772 gleam: Turn findHomepageUrl() into an extension
• 18c1d04 gleam: Turn a var into a val
• 2416632 gleam: Use lateinit for projectDirs
• c533a34 gleam: Use a more speaking name for *deps
• dd56336 gleam: Use named arguments for ProjectAnalyzerResult
• 883329c gleam: Use separate TOML mappers per format
• 44d595c model: Prefer asList() over toList() to avoid allocations

🚀 Dependency Updates

• e05644c update actions/upload-artifact action to v6
• 00b98de update actions/upload-artifact digest to ea165f8
• 22e5671 update ch.qos.logback:logback-classic to v1.5.22
• 3b7dd69 update com.icegreen:greenmail to v2.1.8
• 0deb495 update github artifact actions
• 8c924d9 update github/codeql-action digest to 1b168cd
• 53015d4 update github/codeql-action digest to 5d4e8d1
• 7e32839 update jetbrains/qodana-action action to v2025.2.4
• e50650e update ksp monorepo to v2.3.4
• 872c132 update log4j2 monorepo to v2.25.3
• d5cb608 update org.metaeffekt.core:ae-security to v0.150.0
• 8cc0372 update org.springframework:spring-core to v7.0.2

🚜 Refactorings

• 7961258 gleam: Add EMPTY constant to GleamManifest
• 4a91549 gleam: Encapsulate HexModel deserialization
• 23fc856 gleam: Introduce an enum for the scopes
• 1a645b4 gleam: Migrate to DependencyGraphBuilder
• cf8b34d gleam: Nest GleamToml helper types as inner classes
• a73a36c gleam: Replace string literals with enum for source types
• 957902f gleam: Simplify filtering definition files

💡 Other Changes

• 7d595d1 style(package-managers): Trivially align setContext() functions

73.0.0

What's Changed

🛠 Breaking Changes

• a436211 refactor(evaluator)!: Allow multiple license sources in a LicenseRule
• 0d15a3d refactor(evaluator)!: Turn licenseSource of violations to a Set

🐞 Bug Fixes

• f7aa322 fossid-webapp: Always create a new scan when delta scans are disabled
• 204a248 fossid-webapp: Make identificationCopyright nullable
• 761729b fossid-webapp: File.licenses can be an empty array
• 73dd971 fossid-webapp: comments can be an empty array
• 3da8f9b fossid-webapp: components can be an empty array
• beafb64 python: Do not fail if only one of binary or source analysis fails

🎉 New Features

• 3bc2f50 cli-helper: Add support for authors in package-list.yml
• 86da192 evaluator: Add API's for backwards compatibility
• 69b1d49 evaluator: Allow to evaluate license sources together
• 991e258 spdx-utils: Map "Common Public 1.0" to CPL-1.0

✅ Tests

• a2ab0b2 fossid-webapp: Add functions for the clone repository workflow
• 399df9f fossid-webapp: Add functions for the upload archive mode workflow
• 58f54da fossid-webapp: Extract a test body response

🐘 Build & ⚙️ CI

• 58443a3 release: Increase timeout for validating Maven Central deployment

📖 Documentation

• 81fa99f Improve OTHER comment for Reason enums
• f69e62c fix ScanCode plugin commandLine default badge

🔧 Chores

• fbc5a5c bundler: Merge a call chain to simplify code
• 5e3eb92 evaluator: Update the OSADL matrix to "2025-10-30T11:23:00+0000"
• d6e3f1d fossid-webapp: Create constants for hard-coded strings
• b1d52e6 go: Introduce a better name for the direct proxy option
• a4a4b59 license-fact-providers: Separate fallback dir from export dir
• 5cb3d0c maven: Extend the expiration time to 24 hours
• 08427de maven: Re-introduce cache eviction by size

🚀 Dependency Updates

• 1041285 update aws-java-sdk-v2 monorepo to v2.40.5
• 8680e7b update codecov/codecov-action digest to 671740a
• 92cb26d update dependency prettier to v3.7.4
• 9e2dc86 update github/codeql-action digest to cf1bb45
• 7670355 update io.github.irgaly.kottage:kottage to v1.10.0
• c6358db update io.mockk:mockk to v1.14.7
• 1190661 update mavenresolver to v1.9.25

🚜 Refactorings

• a377370 bundler: Move GemInfo to its own file for a better overview
• 886221a maven: Migrate from DiskLruCache to Kottage

72.3.0

What's Changed

🐞 Bug Fixes

• db2bb19 Maven: Handle automatically wrapped p2 dependencies

🎉 New Features

• 65dbe30 license-fact-providers: Run the license export as a fallback
• 376cb0a yarn2: Disable the execution of postinstall scripts
• 483215f yarn2: Enforce using the "node-modules" node linker

🔧 Chores

• 5b452f3 license-fact-providers: Put an extension property before a function
• 4a92dda license-fact-providers: Use a bit more compact fallback code

🚀 Dependency Updates

• 1b60462 update jetbrains/qodana-action action to v2025.2.3

🚜 Refactorings

• 207f9bd license-fact-providers: Extract getting the license text dir
• 1bc5d1d yarn2: Do not set the node linker for yarn info