Update dependency org.ossreviewtoolkit:analyzer to v91

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.ossreviewtoolkit:analyzer (source)	90.0.0 → 91.0.0

---

Release Notes

oss-review-toolkit/ort (org.ossreviewtoolkit:analyzer)

v91.0.0

Compare Source

What's Changed

🛠 Breaking Changes

• 02e4a2d chore(license-fact-providers)!: Do not use "Provider" in the plugin ID
• d67da13 refactor(model)!: Use a more speaking name for DirLicenseFactProvider
• 8fe0b5b refactor(vulnerable-code)!: Use API v3 by default

🐞 Bug Fixes

• f405b39 commands: Support listing license-fact-provider plugin types
• 8e9ba4c vulnerable-code: Normalize also the API v1 URL
• 4cbd614 Support associating LicenseRef exceptions to licenses

🎉 New Features

• b9749a1 common-utils: Add helper functions to ensure prefix / suffix strings
• 25bb428 freemarker: Enhance licensesNotInLicenseFiles()
• 68eed69 license-fact-provider: Add a LicenseTextCurationProvider
• d229841 model: Add DefaultLicenseTextCurationProvider to default config
• a34c3a7 model: Add a data class for license text curations
• b30d6ab vulnerable-code: Add support for API v3
• bb5e09d Prefer a single applicable license over NOASSERTION for association

⚡ Performance Enhancements

• d92b066 vulnerable-code: Only query advisories for PURLs that have results

✅ Tests

• cc39d4b license-fact-provider: Use a more speaking name for licenseDir
• 91f4e6a scancode: Rename a test class
• f133e55 scancode: Showcase a current failure in exception association

🐘 Build & ⚙️ CI

• 388347b clients: Add kfx codegen setup for VulnerableCode

📖 Documentation

• ac0803e ADOPTERS: Update Double Open's contact details and description
• 2a62bb4 advisor: Move the data sources links from client to advisor
• 89e08bc go: Document that test dependencies of projects are omitted
• ef6b699 license-fact-providers: Fixup a display name
• 0b01b87 license-fact-providers: Reword summaries
• 46282f4 scancode: Make a test name refer to the correct function
• 1ca1b36 vulnerable-code: Mention that API v1 is deprecated
• 444fa63 website: Fix the link to a renamed license texts provider

🔧 Chores

• 3deed82 commands: Fail for unknown plugin types
• 0549561 commands: List plugin descriptions
• 9713e92 spdx-expression: Adjust a private constant name
• 4fdbcd8 spdx-expression: Prefer the in operator for a Regex check
• 37f5795 vulnerable-code: Extract shared utilities
• b2b2e15 vulnerable-code: Log details about the throwable on error
• 740aec6 vulnerable-code: Remove a superfluous type specifier
• 25510ef vulnerable-code: Simplify test helper functions

🚀 Dependency Updates

• 5873bae docker: Upgrade Provenant to version 0.2.1
• ed02494 update at.yawk.lz4:lz4-java to v1.11.1
• 024f8f4 update docker/login-action action to v4.3.0
• 25fdd50 update docker/login-action action to v4.4.0
• 88aa662 update docker/metadata-action action to v6.2.0
• 2fd31c7 update docker/setup-buildx-action action to v4.2.0
• 4976a6d update github/codeql-action action to v4.36.3
• a790cf4 update graalvm/setup-graalvm action to v1.6.0
• 0367698 update jirarestclient to v7.0.2
• acbda51 update log4j2 monorepo to v2.26.1

🚜 Refactorings

• 5719d27 clients: Patch schema and add workarounds
• b637e5e license-fact-provider: Rename scanCodeLicenseTextDir
• 4c45d4f model: Factor out isMatchedBy()
• 15e1c11 model: Factor out matchesDisregardingVersion()
• 2fa0f2b spdx-expression: Factor out isException() for reuse
• 90ca2dd vulnerable-code: Create a VC instance only once per test
• dfe465a vulnerable-code: Extract some constants to a common location
• d2c90ab vulnerable-code: Prepare for multiple API versions

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.