chore: release v0.1.4

[github-actions]

🤖 New release

• dependable-core: 0.1.3 -> 0.1.4 (✓ API compatible changes)
• dependable-fetch: 0.1.3 -> 0.1.4 (✓ API compatible changes)
• dependable-tui: 0.1.3 -> 0.1.4 (✓ API compatible changes)
• dependable-report: 0.1.3 -> 0.1.4
• dependable: 0.1.3 -> 0.1.4

Changelog

dependable-core

0.1.4 - 2026-09-01

Added

• (core) tell a workspace-inherited dependency from a path one
• (core) carry the registry-declared license on CheckResult
• (core) advisory data model on CheckResult

Fixed

• (core) gate a reported location on the position, not on the rewrite

Other

• Merge remote-tracking branch 'origin/master' into feat/82-gradle-version-catalogs
• Merge pull request refactor(fetch)!: generalize workspace inheritance beyond Cargo.toml #90 from getkono/refactor/83-generalize-workspace-inheritance
• (core) describe where a workspace root lives per manifest kind
• (core) refresh doc comments that still describe a Rust-only V1

dependable-fetch

0.1.4 - 2026-09-01

Added

• (core) report a manifest we recognise but cannot read
• (fetch) fetch versions from Maven Central
• (fetch) resolve a member's inherited constraints in the Checker
• (core) tell a workspace-inherited dependency from a path one
• (fetch) collect registry-declared licenses as an opt-in check pass
• (osv) detailed advisory enrichment (CVSS, severity, fixed versions, refs)
• (osv) fetch full advisory records with computed CVSS scores

Fixed

• (fetch) let a scanned module reach the build root that declares it
• (fetch) choose among versions that translate alike by comparing them
• (fetch) bound the supersession walk, and ask who governs a subdirectory
• (jvm) decide a Maven flavour from the published list, not from one word
• (fetch) report the newest spelling when two versions translate alike
• (fetch) report the version the registry publishes, not its translation
• (fetch) resolve an unread build script against its build root
• (fetch) report a canonical root without the Windows verbatim prefix
• (fetch) resolve inheritance against a real ancestor, before the lockfile
• (core) gate a reported location on the position, not on the rewrite
• (list) fetch each crate's features once per run
• (pypi) resolve the license from PEP 639 and classifiers before free text

Other

• (fetch) resolve workspace roots from the manifest-kind descriptor
• (core) refresh doc comments that still describe a Rust-only V1
• compare workspace roots after the same normalization the code applies
• (fetch) assert one registry request across manifests sharing a package

dependable-tui

0.1.4 - 2026-09-01

Added

• (core) report a manifest we recognise but cannot read

Fixed

• (fetch) resolve an unread build script against its build root

dependable-report

0.1.4 - 2026-09-01

Added

• (jvm) wire the JVM ecosystem end to end
• (core) tell a workspace-inherited dependency from a path one
• (report) enforce [policy] allowed_licenses with an unknown-license knob
• (report) SPDX subset evaluator for license expressions
• (report) HTML vulnerability reports via minijinja
• (report) aggregate counts via Report::summary()
• (report) [policy] schema and rule evaluator
• (report) scaffold dependable-report crate

Fixed

• (core) gate a reported location on the position, not on the rewrite

Other

• Merge remote-tracking branch 'origin/feat/17-policy-engine' into stack/v2-r2

dependable

0.1.4 - 2026-09-01

Added

• (cli) say which manifest an inherited constraint came from
• (core) tell a workspace-inherited dependency from a path one
• (report) SARIF v2.1.0 output
• (report) scaffold dependable-report crate

Fixed

• (fix) decline any constraint carrying an @
• (fix) catch a wildcard segment wearing a suffix
• (fix) decline to rewrite a wildcard constraint
• (fetch) report a canonical root without the Windows verbatim prefix
• (fetch) resolve inheritance against a real ancestor, before the lockfile
• (core) gate a reported location on the position, not on the rewrite
• (sarif) make the scan-root test fixture absolute on Windows

Other

• Merge remote-tracking branch 'origin/master' into feat/82-gradle-version-catalogs
• Merge pull request refactor(fetch)!: generalize workspace inheritance beyond Cargo.toml #90 from getkono/refactor/83-generalize-workspace-inheritance
• (fix) say why the wildcard decline is blanket rather than per-ecosystem
• (fix) show a wildcard constraint is narrowed to a pin
• compare workspace roots after the same normalization the code applies
• (cli) drop the runner's private copy of workspace discovery
• Merge remote-tracking branch 'origin/master' into upd79
• Merge remote-tracking branch 'origin/master' into upd78
• Merge remote-tracking branch 'origin/master' into upd77
• Merge remote-tracking branch 'origin/master' into upd76
• Merge remote-tracking branch 'origin/master' into upd75

---

This PR was generated with release-plz.