Repository Issue Activity (beta)

#12117 Extend Advisor to contain project health metrics

#11050 Switch to VulnerableCode API v3 (by 30th, June, 2026)

#11668 Enable package individualized license texts

#12057 ScanOss looses `NOASSERTION` snippets once choosen as original finding

#7023 Make `SpdxDocument` deterministic by sorting collections during serialization

#10930 Print link to docs when outputing rule violations

#12058 ScanOss ignores line range of snippet choices

#11644 Extend the ORT advisor model with fixed version information

#11647 Spdx analyzer ignores `dependsOn` and `contains` relationships — all packages reported as direct top-level dependencies

#11027 Add support for the uv package manager as a Python dependency manager

#3090 DownloaderCommand: Use an exit code of 1 only for fundamental errors

#12032 Duplicated packages error due different Python versions

#11853 Loss of version / revision information for ScanOSS snippet findings

#10125 Adopt Package URL for CycloneDX's bom-ref instead of ORT identifiers

#6465 AnalyzerResultBuilder: improve error message for duplicated packages

#3578 Allow ORT to deal with dependencies that only differ in non-`Identifier` properties (like the classifier for Maven)

#12026 `IvyProcessor` silently ignores version ranges with Maven-style qualifiers in bounds (e.g. `[4.2.13.Final,)`

#12025 Create hint-level issues if excludes / resolutions don't match anything

#12016 GradleInspector fails with NoSuchElementException

#6798 Isolate plugin classpaths from ORT's classpath

#12008 Yarn2 analyzer: "Could not unambiguously resolve locator" on valid multi-version / compat-patch lockfiles

#11794 SPDX reporter crashes on `Map.getValue()`

#11823 SpdxDocumentModelMapper: Revisit dependency relationship creation iteration(s)

#11484 FileArchiver creates unnecessary archives

#11135 Add OSPAC rules as evaluator preset