Update dependency org.ossreviewtoolkit:analyzer to v90

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.ossreviewtoolkit:analyzer (source)	89.3.0 → 90.0.0

---

Release Notes

oss-review-toolkit/ort (org.ossreviewtoolkit:analyzer)

v90.0.0

Compare Source

What's Changed

🛠 Breaking Changes

• b4ea79f feat(model)!: Support multiple license fact providers of the same type
• f15e509 refactor!: Move the ORT_CUSTOM_LICENSE_TEXTS_DIRNAME constant

🐞 Bug Fixes

• dabfe95 license-fact-provider: Avoid infinite recursive calls
• f5e6248 mise: Add ssh as a required tool from the host
• b89dfd6 scanoss: Handle licenses only SCANOSS knows about for snippets
• 7178b63 scanoss: Handle unparsable license names for snippets
• 531304d scanoss: Maintain NOASSERTION also for empty license findings

🎉 New Features

• df1f0f0 license-fact-provider: Return a set of texts per id
• e9c2b3d spdx: Make SpdxDocument serialization deterministic

✅ Tests

• 6d9b2e6 conan: Update expected results
• d821044 scanoss: Add some coverage for getLicenseFindings()
• 2e9ba11 scanoss: Add some coverage for getSnippetFindings()

📖 Documentation

• f014881 examples: Correct Apache-2.0 license spelling
• 1469697 provenant: Further improve class docs
• eccc4af scanner: Note that the Provenant integration is experimental

🔧 Chores

• 001b213 license-fact-provider: Clarify and fix semantics of licenseId
• add01e5 license-fact-provider: Use a more speaking name for licenseId
• 1d7d695 mise/flox: Add convenient ways to run Gradle tasks
• fb3d273 model: Illustrate defining multiple license fact providers
• dbc0268 model: Re-align the order of license fact providers
• bf54d57 scanoss: Remove license expression sorting from the model
• 0b12599 spdx: Drop sorting now handled by serialization converters
• cf8878e spdx: Introduce constants for NONE / NOASSERTION as expressions
• 3568dde website: Replace deprecated onBrokenMarkdownLinks

🚀 Dependency Updates

• c80b848 docker: Pin Corepack to version 0.34.7
• f9cad6b update actions/attest-build-provenance action to v4.1.1
• bb55a4a update actions/setup-java action to v5.4.0
• c04207c update aws-java-sdk-v2 monorepo to v2.46.20
• e017c97 update ch.qos.logback:logback-classic to v1.5.36
• 803fbb8 update ch.qos.logback:logback-classic to v1.5.37
• ec98593 update com.autonomousapps.build-health to v3.16.0
• ffb0db1 update com.scanoss:scanoss to v0.13.1
• cea6811 update dev.aga.gradle.version-catalog-generator to v4.2.1
• 6fcae3b update docker/build-push-action action to v7.3.0
• 41a020d update exposed to v1.3.1
• c6d6e8d update gradle to v9.6.1
• e22dbff update io.ktor:ktor-version-catalog to v3.5.1
• 35e959c update org.graalvm.buildtools:native-gradle-plugin to v1.1.3
• 39fd2b4 update org.metaeffekt.core:ae-security to v0.156.3
• f759873 update org.postgresql:postgresql to v42.7.12
• 3bfc39f update org.spdx:java-spdx-library to v2.0.4
• b8869c4 update org.spdx:spdx-v3jsonld-store to v1.0.5
• 02a264e update react monorepo to v19.2.7

🚜 Refactorings

• bb0b814 scanoss: Extract license mapping to a common function
• ca08e46 scanoss: Factor out a licenses variable

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.