Update native Brotli and dr_libs

.ort/package-configurations/brotli.yml

@@ -1,11 +1,11 @@
 {
-  "id": "SpdxDocumentFile:vcpkg:brotli:1.2.0",
-  "source_artifact_url": "http://127.0.0.1:8765/sources/816c96e8e8f193b40151dad7e8ff37b1221d019dbcb9c35cd3fadbfe6477dfec.tar.gz",
+  "id": "SpdxDocumentFile:vcpkg:brotli:1.2.1",
+  "source_artifact_url": "http://127.0.0.1:8765/sources/98d35d11a78dc453aebb7d10c3748f3f73ff78c8267c0dc697b8631f67bf7e8f.tar.gz",
   "path_excludes": [
     {
-      "pattern": "brotli-1.2.0/CONTRIBUTING.md",
+      "pattern": "brotli-1.2.1/CONTRIBUTING.md",
       "reason": "DOCUMENTATION_OF",
-      "comment": "Upstream contribution guide. Line 31 is the Google corporate CLA reference ([Software Grant and Corporate Contributor License Agreement]) that ScanCode reports as NOASSERTION; it is a non-code contribution document, not a grant of the library. The MIT source grants (the root LICENSE and every c/** header) stay detected unchanged. Anchored on the archive top directory brotli-1.2.0/ that the real ORT ScanCode run keeps in the extracted tree."
+      "comment": "Upstream contribution guide. Line 31 is the Google corporate CLA reference ([Software Grant and Corporate Contributor License Agreement]) that ScanCode reports as NOASSERTION; it is a non-code contribution document, not a grant of the library. The MIT source grants (the root LICENSE and every c/** header) stay detected unchanged. Anchored on the archive top directory brotli-1.2.1/ that the real ORT ScanCode run keeps in the extracted tree. CONTRIBUTING.md is byte-identical to1.2.0 in the verified1.2.1 source archive; this retains only the existing documentation scope."
     }
   ]
 }

.ort/package-configurations/drlibs.yml

@@ -1,23 +1,23 @@
 {
-  "id": "SpdxDocumentFile:vcpkg:drlibs:2026-08-31",
-  "source_artifact_url": "http://127.0.0.1:8765/sources/a57b4c054240bf7debd9fd58ecae8f47d55cae2addd0eee6c5a6569b3cec6f34.tar",
+  "id": "SpdxDocumentFile:vcpkg:drlibs:2026-11-11",
+  "source_artifact_url": "http://127.0.0.1:8765/sources/aa971fb36a7a147157e7726ec2311e1d46bd2d3cc80ce70efebdda9ce61e807a.tar",
   "license_finding_curations": [
     {
-      "path": "dr_libs-dfe8377631000664666519fdb83da193fd8037f4-dr_mp3.h",
+      "path": "dr_libs-f12e197fd462e4c22873fbd70d11b1d2f2c1dc3c-dr_mp3.h",
       "start_lines": 2,
       "line_count": 1,
       "detected_license": "LicenseRef-scancode-unknown-license-reference",
       "reason": "CODE",
-      "comment": "Line 2 says the file is public domain and refers the reader to the license section at the end of the file; the footer (lines 5380-5422) offers Unlicense or MIT-0. The reference is not a separate license, and the real grants remain detected in the footer. The embedded lieff/minimp3 CC0 dedication at lines 5427-5429 is genuine provenance and is preserved.",
+      "comment": "Line 2 says the file is public domain and refers the reader to the license section at the end of the file; the footer (lines 5173-5215) offers Unlicense or MIT-0. The reference is not a separate license, and the real grants remain detected in the footer. The embedded lieff/minimp3 CC0 dedication at lines 5220-5222 is genuine provenance and is preserved. The scoped line2 text and complete grant footer are byte-identical to the prior reviewed snapshot; no new scanner observation is claimed.",
       "concluded_license": "NONE"
     },
     {
-      "path": "dr_libs-dfe8377631000664666519fdb83da193fd8037f4-dr_wav.h",
+      "path": "dr_libs-f12e197fd462e4c22873fbd70d11b1d2f2c1dc3c-dr_wav.h",
       "start_lines": 2,
       "line_count": 1,
       "detected_license": "LicenseRef-scancode-unknown-license-reference",
       "reason": "CODE",
-      "comment": "Line 2 refers to the license section at the end of the file, whose footer (lines 9166-9208) offers Unlicense or MIT-0. The reference is not a separate license; the real grants stay detected.",
+      "comment": "Line 2 refers to the license section at the end of the file, whose footer (lines 8677-8719) offers Unlicense or MIT-0. The reference is not a separate license; the real grants stay detected. The scoped line2 text and complete grant footer are byte-identical to the prior reviewed snapshot; no new scanner observation is claimed.",
       "concluded_license": "NONE"
     }
   ]

.ort/package-configurations/unpackrat-build-tests-godot-minimal-registration.yml

@@ -1,15 +1,15 @@
 {
-  "id": "SpdxDocumentFile:vcpkg:unpackrat-build-tests-godot-minimal-registration:d213197f852ae31709506a4cbcfbbf9f86b051fd12061aa3c204642fc510aadc",
-  "source_artifact_url": "http://127.0.0.1:8765/sources/d213197f852ae31709506a4cbcfbbf9f86b051fd12061aa3c204642fc510aadc.tar",
+  "id": "SpdxDocumentFile:vcpkg:unpackrat-build-tests-godot-minimal-registration:6cf4db24494dd28bc7d3b323ed7e335851eb22fb9a88e29e1d98ade2c0d4bff3",
+  "source_artifact_url": "http://127.0.0.1:8765/sources/6cf4db24494dd28bc7d3b323ed7e335851eb22fb9a88e29e1d98ade2c0d4bff3.tar",
   "license_finding_curations": [
     {
       "path": "build/tests/test_godot_minimal_registration.py",
-      "start_lines": "69,87,217",
+      "start_lines": "70,88,218",
       "line_count": 1,
       "detected_license": "GPL-3.0-only",
       "reason": "INCORRECT",
       "concluded_license": "NONE",
-      "comment": "Lines 69,87,217 share the identifier GPL-3.0-only; line 69 is, for example, `\"GPL-3.0.txt\",`. These are example literals in first-party MIT build/test tooling, not grants, so the false-positive finding is removed."
+      "comment": "Lines 70,88,218 share the identifier GPL-3.0-only; line 70 is, for example, `\"GPL-3.0.txt\",`. These are example literals in first-party MIT build/test tooling, not grants, so the false-positive finding is removed."
     }
   ]
 }

.ort/package-configurations/unpackrat-build-tests-license-package-configurations.yml

@@ -1,51 +1,51 @@
 {
-  "id": "SpdxDocumentFile:vcpkg:unpackrat-build-tests-license-package-configurations:aa34ef18c34a9804f5fd8c6f581832855738888211699fe83c2e5a1e67dc5bd3",
-  "source_artifact_url": "http://127.0.0.1:8765/sources/aa34ef18c34a9804f5fd8c6f581832855738888211699fe83c2e5a1e67dc5bd3.tar",
+  "id": "SpdxDocumentFile:vcpkg:unpackrat-build-tests-license-package-configurations:47c9335cf1ef63875cf2c2402c81b9c3ac47d9e0ac4068674f51cabfbd014b6b",
+  "source_artifact_url": "http://127.0.0.1:8765/sources/47c9335cf1ef63875cf2c2402c81b9c3ac47d9e0ac4068674f51cabfbd014b6b.tar",
   "license_finding_curations": [
     {
       "path": "build/tests/test_license_package_configurations.py",
-      "start_lines": "311,399,533,535,539,541,560,564",
+      "start_lines": "315,403,537,539,543,545,564,568",
       "line_count": 1,
       "detected_license": "GPL-1.0-or-later",
       "reason": "INCORRECT",
       "concluded_license": "NONE",
-      "comment": "Lines 311,399,533,535,539,541,560,564 share the identifier GPL-1.0-or-later; line 311 is, for example, `\"detected_license\": \"GPL-1.0-or-later\",`. These are example literals in first-party MIT build/test tooling, not grants, so the false-positive finding is removed."
+      "comment": "Lines 315,403,537,539,543,545,564,568 share the identifier GPL-1.0-or-later; line 315 is, for example, `\"detected_license\": \"GPL-1.0-or-later\",`. These are example literals in first-party MIT build/test tooling, not grants, so the false-positive finding is removed."
     },
     {
       "path": "build/tests/test_license_package_configurations.py",
-      "start_lines": "279,320,336,350,536,538,542,544,587,596,604,662",
+      "start_lines": "283,324,340,354,540,542,546,548,591,600,608,666",
       "line_count": 1,
       "detected_license": "GPL-2.0-only",
       "reason": "INCORRECT",
       "concluded_license": "NONE",
-      "comment": "Lines 279,320,336,350,536,538,542,544,587,596,604,662 share the identifier GPL-2.0-only; line 279 is, for example, `\"detected_license\": \"GPL-2.0-only OR Apache-2.0\",`. These are example literals in first-party MIT build/test tooling, not grants, so the false-positive finding is removed."
+      "comment": "Lines 283,324,340,354,540,542,546,548,591,600,608,666 share the identifier GPL-2.0-only; line 283 is, for example, `\"detected_license\": \"GPL-2.0-only OR Apache-2.0\",`. These are example literals in first-party MIT build/test tooling, not grants, so the false-positive finding is removed."
     },
     {
       "path": "build/tests/test_license_package_configurations.py",
-      "start_lines": "329,343,357,404",
+      "start_lines": "333,347,361,408",
       "line_count": 1,
       "detected_license": "GPL-2.0-or-later",
       "reason": "INCORRECT",
       "concluded_license": "NONE",
-      "comment": "Lines 329,343,357,404 share the identifier GPL-2.0-or-later; line 329 is, for example, `\"detected_license\": \"GPL-2.0-or-later\",`. These are example literals in first-party MIT build/test tooling, not grants, so the false-positive finding is removed."
+      "comment": "Lines 333,347,361,408 share the identifier GPL-2.0-or-later; line 333 is, for example, `\"detected_license\": \"GPL-2.0-or-later\",`. These are example literals in first-party MIT build/test tooling, not grants, so the false-positive finding is removed."
     },
     {
       "path": "build/tests/test_license_package_configurations.py",
-      "start_lines": "540",
+      "start_lines": "544",
       "line_count": 1,
       "detected_license": "GPL-3.0-only",
       "reason": "INCORRECT",
       "concluded_license": "NONE",
-      "comment": "Line 540 carries `\"line_count\": 1, \"detected_license\": \"GPL-3.0-only\"},`. This first-party MIT build/test file holds the identifier only as the exact string it exercises or documents, not a grant; ScanCode reported GPL-3.0-only as a false positive, so the finding is removed."
+      "comment": "Line 544 carries `\"line_count\": 1, \"detected_license\": \"GPL-3.0-only\"},`. This first-party MIT build/test file holds the identifier only as the exact string it exercises or documents, not a grant; ScanCode reported GPL-3.0-only as a false positive, so the finding is removed."
     },
     {
       "path": "build/tests/test_license_package_configurations.py",
-      "start_lines": "287,305,312,358,388",
+      "start_lines": "291,309,316,362,392",
       "line_count": 1,
       "detected_license": "LicenseRef-scancode-unknown",
       "reason": "INCORRECT",
       "concluded_license": "NONE",
-      "comment": "Lines 287,305,312,358,388 share the identifier LicenseRef-scancode-unknown; line 287 is, for example, `\"concluded_license\": \"NONE\",`. These are example literals in first-party MIT build/test tooling, not grants, so the false-positive finding is removed."
+      "comment": "Lines 291,309,316,362,392 share the identifier LicenseRef-scancode-unknown; line 291 is, for example, `\"concluded_license\": \"NONE\",`. These are example literals in first-party MIT build/test tooling, not grants, so the false-positive finding is removed."
     }
   ]
 }

build/license-inventory.json

@@ -379,18 +379,18 @@
       "packaged": true,
       "incorporated": true,
       "declaredExpression": "MIT",
-      "version": "1.2.0",
+      "version": "1.2.1",
       "vcpkgName": "brotli",
       "source": {
         "origin": "registry",
         "recipe": "ports/brotli/portfile.cmake",
         "patches": [],
-        "url": "https://github.com/google/brotli/archive/v1.2.0.tar.gz",
+        "url": "https://github.com/google/brotli/archive/v1.2.1.tar.gz",
         "sha512": [
-          "f94542afd2ecd96cc41fd21a805a3da314281ae558c10650f3e6d9ca732b8425bba8fde312823f0a564c7de3993bdaab5b43378edab65ebb798cefb6fd702256"
+          "460591287d428c8b5a8a2766b5b424d14501fcda12c7118b8f3cc4bfae44b90ac75ca156557f07b6e22542612724d904533e5f70019be07dbbb604c46f03ab69"
         ],
         "sha256": [
-          "816c96e8e8f193b40151dad7e8ff37b1221d019dbcb9c35cd3fadbfe6477dfec"
+          "98d35d11a78dc453aebb7d10c3748f3f73ff78c8267c0dc697b8631f67bf7e8f"
         ],
         "identity": "github.com/google/brotli"
       },
@@ -599,8 +599,8 @@
         "build/vcpkg/ports/drlibs/copyright": "8b2a772e9b30885997130bc8e0cfb07c238990fa433078649d251a1c5c7a3f64",
         "build/vcpkg/ports/drlibs/dr_mp3.c": "8a8f7911b316379d64400787abc871a61c2f76116e709a3e5b7001e77205af9f",
         "build/vcpkg/ports/drlibs/dr_wav.c": "550460509d1236e7ae85726f2e63511d76cef764b2730c8ead2c15a7bf0eba0e",
-        "build/vcpkg/ports/drlibs/portfile.cmake": "47acd54ed599ee14af582bf3f3831dff584b0a9f6f6fe128bfc8d5d66bbe1808",
-        "build/vcpkg/ports/drlibs/vcpkg.json": "76d471f45ecd9c537972820fa277bf806e5f5be289f1e5c1d687cf7b4c8f0090",
+        "build/vcpkg/ports/drlibs/portfile.cmake": "eaedc25792c12f5d8b6c02b1c16cbf15d0846badc350afeb28ba22837db35db2",
+        "build/vcpkg/ports/drlibs/vcpkg.json": "bf6b85a1610206a1ca4ed83ed759ffef0d10f66e4aa32c842c5b827afbe6f6ec",
         "build/vcpkg/triplets/unpackrat-x86-windows-static.cmake": "7f706840bc922781120cbd607e0f5a6008f0562e2178f9127f7bc8ea7d5754ab",
         "build/vcpkg/triplets/unpackrat-x64-windows-static.cmake": "e198af9bb1ccf802c74357faf1b90c2c808694112007dc71cc27fe10f21be6d7"
       },
@@ -612,20 +612,20 @@
       "incorporated": true,
       "declaredExpression": "(Unlicense OR MIT-0)",
       "licenseChoice": null,
-      "version": "2026-08-31",
+      "version": "2026-11-11",
       "vcpkgName": "drlibs",
       "source": {
         "origin": "overlay",
         "recipe": "build/vcpkg/ports/drlibs/portfile.cmake",
         "patches": [],
-        "url": "https://github.com/mackron/dr_libs/blob/dfe8377631000664666519fdb83da193fd8037f4/dr_mp3.h",
+        "url": "https://github.com/mackron/dr_libs/blob/f12e197fd462e4c22873fbd70d11b1d2f2c1dc3c/dr_mp3.h",
         "sha512": [
-          "c21d523bdd890bf8b2e84ff7ac63f72299b235834b424d95d281b57c4e22d260e23e423ed8d829e710cbd11d8814c69afef24cb9e576bbb9cb0b704be94bf8ed",
-          "277ada6b7cf940f557d38dea7985db129c8aaf034c23425da3f1681e901439bbd4152a766de5a26cc7ddb3f0a00f2ce8f6496f61c359bc65889eeac25e356bd3"
+          "d31c0161928d7e3c2158b9a79a8db2b1ac37b8c81d4087ea499bb37f6b2591e6922e1288ae12047907da8c91ee828832f968b7cff44f8fd81e681a7b69ccbde9",
+          "88a622fa07f7bea5a4467340743ee20c7987170a2dba7579a5f44aff2d5e24ce73d9294cf591df8740df4bba6b64dc9ee18e5a21173b54ba72e649175c91e255"
         ],
         "sha256": [
-          "997b7ee18de6e6b81e2a83f1ea9fc62aef25c62b28d48db95635f49e65de0a2f",
-          "03e70c1a2d9787cd7ed3e966c075bea7bac6373f759db9cd7ca9ccdfc4ec4493"
+          "7a6cc38b0afdb55cfc9eec991d9169d67beb8fd910be2995121510cdaa99c356",
+          "7c9660d75361ad6175e6217c63a1075c9512445c06bc951197fc479179f76b39"
         ],
         "identity": "github.com/mackron/dr_libs"
       },

build/tests/fixtures/license_package_configurations/expected_artifacts.json

@@ -11,7 +11,8 @@
     "download name rather than the shortened name an earlier manual audit used. The",
     "header bytes are identical between the shortened and the real bundles, so the",
     "reviewed scan line matches are unchanged; only the member name and the resulting",
-    "deterministic tar hash differ."
+    "deterministic tar hash differ.",
+    "Brotli1.2.1 and drlibs2026-11-11 identities were renewed2026-11-12 from verified official source bytes; scanner observations remain historical and current test expectations are explicitly labelled derived."
   ],
   "components": [
     {
@@ -31,9 +32,9 @@
     },
     {
       "name": "brotli",
-      "version": "1.2.0",
-      "sha256": "816c96e8e8f193b40151dad7e8ff37b1221d019dbcb9c35cd3fadbfe6477dfec",
-      "artifact_filename": "816c96e8e8f193b40151dad7e8ff37b1221d019dbcb9c35cd3fadbfe6477dfec.tar.gz",
+      "version": "1.2.1",
+      "sha256": "98d35d11a78dc453aebb7d10c3748f3f73ff78c8267c0dc697b8631f67bf7e8f",
+      "artifact_filename": "98d35d11a78dc453aebb7d10c3748f3f73ff78c8267c0dc697b8631f67bf7e8f.tar.gz",
       "extension": ".tar.gz"
     },
     {
@@ -45,9 +46,9 @@
     },
     {
       "name": "drlibs",
-      "version": "2026-08-31",
-      "sha256": "a57b4c054240bf7debd9fd58ecae8f47d55cae2addd0eee6c5a6569b3cec6f34",
-      "artifact_filename": "a57b4c054240bf7debd9fd58ecae8f47d55cae2addd0eee6c5a6569b3cec6f34.tar",
+      "version": "2026-11-11",
+      "sha256": "aa971fb36a7a147157e7726ec2311e1d46bd2d3cc80ce70efebdda9ce61e807a",
+      "artifact_filename": "aa971fb36a7a147157e7726ec2311e1d46bd2d3cc80ce70efebdda9ce61e807a.tar",
       "extension": ".tar",
       "bundle": true
     },