v1.14.0

1.14.0 - 2026-07-27

• Added Zig build.zig.zon dependency manifest support. Ohrisk parses
  .dependencies entries with url/hash and path fields, classifies
  them as zig ecosystem dependencies, and collects license evidence from
  local path dependencies and remote tarballs. Remote URL dependencies are
  downloaded, decompressed, and the Zig package hash is computed via
  per-file SHA-256 (normalized path + [0,0] + contents) then overall
  SHA-256 of concatenated per-file hashes. The .paths field in
  build.zig.zon is respected so only declared files contribute to the
  hash, matching zig fetch behavior. Old multihash (1220 + SHA-256
  hex) and new name-version-hashplus formats are both verified. New hashes
  recover the package ID from the fingerprint field in build.zig.zon,
  while manifestless tarballs use Zig's exact N-V placeholder and reserved
  package ID. PAX global metadata headers are handled like zig fetch, and
  license files (LICENSE, COPYING, NOTICE, etc.) are extracted only from the
  verified tarball.