v1.15.2

1.15.2 - 2026-08-27

• pnpm lockfiles split across multiple YAML documents are now merged without
  dropping importer, package, or snapshot data. Ohrisk accepts compatible
  split importer declarations while conflicting dependency values and
  lockfile versions remain fail-closed.

• Package-scoped MIT-CMU inventories such as Pillow's root license now retain
  the package license ahead of later bundled component notices, avoiding false
  conflicting-evidence findings without suppressing those component terms.

• Concurrent packages pinned to the same Cargo GitHub commit now share one
  checksum-verified archive fetch and index operation instead of repeating the
  same immutable-source work for every package.

• Nix flake.lock inputs may collect root legal files from exact NixOS nixpkgs
  release nixexprs.tar.xz archives under both /nixpkgs/... and
  /nixos/<channel>/... layouts. Ohrisk requires a full commit, matching
  12-character release path, canonical narHash, fixed NixOS host, XZ output
  capped at 320 MiB and 100,000 entries, and a matching extracted NAR tree
  before trusting the evidence. XZ output streams through a uniquely named
  temporary TAR file opened with exclusive creation and restricted mode where
  supported; it is removed on success and failure, avoiding complete decompressed
  archive retention in memory.

• Checksum-identified Go module ZIPs may verify up to 65,535 entries and 512 MiB of expanded
  content without retaining unrelated source files. Per-entry, compression-ratio,
  CRC, work, and cancellation limits remain fail-closed, while retained license
  and go.mod evidence stays capped at 34 MiB.

• Checksum-verified Cargo crates now honor an explicit README declaration that
  offers MIT or Apache-2.0 at the user's option. Matching LICENSE-MIT and
  LICENSE-APACHE files no longer produce a false conflicting-evidence finding,
  while narrower -only metadata still conflicts with broader -or-later text.

• A license file that explicitly declares the package as a whole under MIT now
  keeps that package scope ahead of later contributor-only Apache terms, avoiding
  false conflicts for crates such as libm.

• Standard Maven names used by Apache, Hamcrest, HdrHistogram, and JTS now
  normalize to their SPDX expressions instead of producing malformed-license
  findings.

• Yarn Berry cache checksums are now preserved separately from npm tarball
  integrity, so unavailable evidence explains the verification boundary and
  recovery path instead of claiming the lockfile contains no checksum.

• SPDX identifier lines wrapped in Markdown inline-code delimiters now discard
  the closing delimiter before expression parsing, avoiding false conflicts for
  dual-licensed modules such as github.com/DataDog/dd-trace-go/v2.

• SPDX Creative Commons Attribution licenses such as CC-BY-3.0 are now
  attribution review findings instead of unrecognized-license findings.

• Multiple recognized license files no longer conflict when one metadata
  classifier covers every file choice. Named sibling files such as
  LICENSE_zstd.txt are now treated as bundled-component evidence while
  standard LICENSE-MIT, LICENSE-APACHE, and BSD alternatives remain
  package-license choices.

• License-file recognition now handles the parenthetical notice wording used
  by common MIT packages, explicit BSD one-clause and alternate three-clause
  wording, and the bzip2 grant without reporting false metadata conflicts.
  Canonical MPL 2.0 text is also compatible with an MPL-2.0+ declaration,
  and bzip2-1.0.6 is classified as permissive.

• Common Python metadata aliases PSFL and BSD 3-Clause License now
  normalize to PSF-2.0 and BSD-3-Clause. Canonical GNU version text no
  longer conflicts with matching -or-later package metadata, while the
  narrower metadata / broader file direction remains fail-closed.

• Modern uv.lock files may omit versions for editable workspace packages.
  Ohrisk now accepts those records only for project-contained local sources,
  validates their local package metadata, collects bounded license evidence,
  and uses 0.0.0+local as a stable report identity when the project version
  is dynamic. Versionless remote records still fail closed.

• SPDX TCL and WTFPL expressions are now classified as permissive
  low-risk licenses under both profiles. Distributed TCL packages retain
  the normal license-text obligation, while WTFPL does not invent one.

• BSD 3-clause license files whose endorsement condition says Neither the name Example instead of Neither the name of Example are now recognized
  correctly. A license file that explicitly scopes those terms to
  auto-generated bindings is retained as bundled-component evidence instead
  of conflicting with the package declaration, fixing
  zstd-sys@2.0.16+zstd.1.5.7.

• Canonical MIT license files that use typographic quotes around “AS IS”
  are now recognized like their ASCII-quoted form, removing false missing
  findings for modules such as github.com/felixge/fgprof@v0.9.5.

• SPDX BSL-1.0 and Unicode-DFS-2016 are now classified as permissive
  low-risk licenses under both profiles instead of falling through to
  unknown. This fixes false unknown findings for crates such as
  clipboard-win, error-code, and unicode-ident.

• Root legal files that explicitly declare the package as dual-licensed under
  MIT and Apache-2.0 now keep that package-level choice when a later section
  carries a BSD-3-Clause notice scoped to one source file. This removes false
  conflicting-evidence findings for crates such as minimal-lexical@0.2.1
  without relaxing ordinary metadata-versus-license-file conflicts.

• Nix flake.lock public GitHub inputs now preserve a full locked commit and
  SHA-256 narHash, fetch only the exact fixed-host codeload archive after local
  evidence is unavailable, and trust root legal files only after a bounded
  extracted source tree matches Nix Archive serialization. Short revisions,
  malformed hashes, custom hosts, unsupported archive shapes, and hash
  mismatches remain fail-closed.

• Modern Elixir mix.lock public hexpm records now preserve the outer
  tarball SHA-256 and fetch the exact package from repo.hex.pm when local
  deps/ evidence is unavailable. The outer archive checksum, Hex v3 inner
  checksum, metadata name/version, nested archive bounds, and license files are
  verified before evidence is trusted; private and hashless records stay local-only.

• Haskell Stack locks now preserve the completed Hackage Cabal-file SHA-256
  and use it to verify exact remote .cabal license metadata when no local
  package database evidence is available. Host, response-size, UTF-8, package
  identity, and checksum validation remain fail-closed. When the current public
  Cabal file differs, Ohrisk checks at most 64 numbered historical revisions
  and trusts only the revision matching the completed lock checksum.

• Cabal's legacy BSD3 license value is normalized to SPDX BSD-3-Clause
  instead of being reported as malformed.

• Qualified sibling files such as LICENSE.libyaml are now treated as bundled
  component licenses when a primary LICENSE exists beside them. Their
  obligations are combined with SPDX AND instead of producing a false
  package-license conflict.

• THIRD_PARTY_LICENSES* inventories beside a primary license are likewise
  treated as cumulative bundled-component evidence, preventing their contents
  from creating false package-license conflicts.

• Cargo root path dependencies contained by the workspace are now treated as
  implicit workspace members even when omitted from the explicit members
  list, while exclude entries remain authoritative. This restores license
  metadata for internal crates such as Nushell's nu-glob and nu-path.

• Cargo workspace packages now inherit version and license from
  [workspace.package] when their member manifests opt in with
  version.workspace = true and license.workspace = true, eliminating
  false unknown findings for internal crates in repositories such as Ruff.

• Cargo workspace and contained path packages now collect member-root legal
  files, with a workspace-root fallback when the member has none. Git-ref
  baselines use the same bounded snapshot evidence, eliminating false
  unknown findings such as watt@1.4.0 without trusting same-name registry
  artifacts.

• Cargo Git dependencies pinned to a full GitHub commit now collect bounded
  codeload archive evidence after single-root and unique Cargo.toml
  name/version validation. Mutable, credentialed, non-GitHub, path, and
  ambiguous sources remain unavailable. Git legal-file symlinks are resolved
  only to regular entries contained by the same immutable archive root; other
  links are never materialized.

• Localized HTML reports no longer leave the conflicting-license review action
  in English across Korean and the other supported report languages.

• Public repository scans now read Go local replacement evidence only from
  real paths contained by the validated checkout. Internal submodules without
  legal files of their own inherit bounded root-module license evidence,
  avoiding misleading unknown results for repositories such as Terraform
  without enabling general temporary-checkout package or vendor discovery.