deps: update dependency org.ossreviewtoolkit:version-catalog to v89

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.ossreviewtoolkit:version-catalog (source)	88.0.0 → 89.0.0

---

Release Notes

oss-review-toolkit/ort (org.ossreviewtoolkit:version-catalog)

v89.0.0

Compare Source

[!NOTE]
This release starts to build ORT with Java 25, which means that also the implied default Java version that the Gradle(Inspector) and Sbt analyzer use changes from Java 21 to Java 25. Analyzed projects that do not support Java 25 yet need to start explicitly setting the javaVersion for these analyzers in the respective plugin's options.

What's Changed

🛠 Breaking Changes

• 5e28e80 build!: Upgrade to Java 25 to benefit from various optimizations
• f893ace build(gradle)!: Move script definitions to script-utils
• 26be2aa build(scripting)!: Rename the module to just "script" for shortness
• 571af2e refactor!: Rename the ort-config package configuration provider module

🐞 Bug Fixes

• 51f1773 detekt-rules: Correctly determine the root project
• ef3e806 flox: Pass on API keys / PAT variables to the isolated environment
• f7cbbe4 gradle-plugin: Fix-up the caching mechanism
• 5860fde reuse: Add correct licensing information for unoconv files
• dc84c9c scanner: Do not create file archives multiple times
• ffb6488 fa41f4a tycho: Use correct identifiers for mapped packages
• 6643d57 yarn2: Deal with version mismatches
• 365d278 yarn2: Handle dependencies with multiple versions

🎉 New Features

• 362ff86 bazel: Add variable parsing to StarlarkParser
• cbd1d5b gradle-model: Make the representation more memory efficient
• ec245f4 ort-config: Extract a generic GitPackageConfigurationProvider
• 4230e99 spdx-document-file: Imply static linkage for CONTAINS
• 59fa18f spdx-expression: Map "No Copyright" to NONE

✅ Tests

• 924507d cli: Use GradleInspector instead of Gradle in a test
• 2e75615 conan: Update expected results
• 446d287 evaluator: Combine the "access ORT result" with checkSyntax()
• af4b1bd evaluator: Get the OSADL rules only once
• c942f6c model: Add noticeFilenames to OrtConfigurationTest
• 65d27e8 osv: Update expected results
• a3b9cf4 provenant: Remove an enabled-condition
• c2538fa scanoss: Disable failing tests
• 6abd9e7 vulnerable-code: Use an API key if configured

🐘 Build & ⚙️ CI

• 2e06850 gradle: Configure and rerun updateDaemonJvm
• 8f52b97 github: Adjust permissions for reviewdog
• 8683c28 github: Always run Gradle with stacktrace logging
• 75f16de github: Forward secrets to environment variables

📖 Documentation

• 0252e0b evaluator: Improve OSADL rules documentation
• 711ce96 evaluator: Update the path to the OSADL rules example input file
• a86b3a1 scanoss: Fix a typo in a code comment

🔧 Chores

• b8ee6d1 bazel: Add variable parsing tests for Bazel
• 322e7bc bazel: Make StarlarkParser more verbose for MODULE.bazel issues
• 04fe4cc evaluator: Update the OSADL compatibility matrix to 2026-02-12
• bb35656 flox: Align on the schema version and default outputs
• 742aad2 gradle: Reorder tasks definition a bit
• 1cf618c gradle: Replace map with forEach
• 9d51987 gradle-inspector: Log some status around getting the tree model
• 32c9884 gradle-plugin: Move resolvePoms() out of the class
• 6f4b729 gradle-plugin: Trivially simplify obtaining all components
• 4bfbe0f gradle-plugin: Use a more speaking name for dep
• f6db6c2 spdx-document-file: Factor out removeDocumentRefPrefix()
• 49a5f23 test-utils: Remove the ineffective execution order config
• b69dd08 test-utils: Remove unused JunitXmlReporter extension
• 2b50fbc Clean up github-graphql remainders
• 5ec726d Fix package names that slipped through while the check was broken

🚀 Dependency Updates

• 8d3c24b cli: Limit funTest dependencies to the minimum of concrete plugins
• e6b90ee docker: Upgrade Provenant to version 0.1.8
• cbd7340 gradle: Move the Git plugin dependency to the only place needed
• 7d8eade update aws-java-sdk-v2 monorepo to v2.46.8
• 3de77fe update codecov/codecov-action action to v6.0.2
• a8d4874 update codecov/codecov-action action to v7
• bb924a2 update com.autonomousapps.build-health to v3.15.0
• 51c2034 update dependency @​easyops-cn/docusaurus-search-local to v0.55.2
• 60436e6 update github/codeql-action action to v4.36.2
• b83a940 update gitsemverplugin to v0.19.1
• f44d413 update gitsemverplugin to v0.19.2
• bbd5628 update graalvmnativeimageplugin to v1.1.2
• 636f7ad update gradle/actions action to v6.1.1
• 7fac2d9 update jruby to v9.4.15.0
• 0cc6d2a update jsonschemavalidator to v3.0.4
• f71ee2b update okhttp monorepo to v5.4.0
• 8acb4ad update spring core to v7.0.8
• f25ba7c update umbrelladocs/action-linkspector action to v1.5.3

🚜 Refactorings

• 287844e gradle: Inline the code from gradle-model
• 405094c gradle-model: Introduce an OrtComponentIdentifier
• 393483a gradle-model: Rename OrtDependency to OrtComponent
• 20f0e14 gradle-plugin: Move a distinct() downwards in call tree
• 9909617 spdx-document-file: Use a map to find relationships

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.