The constructor o.s.r.project.Dependency#Dependency(String, String, String, DependencyType, DependencyScope) added in commit
60ae6a8467e4b5628154f90042d6d45d8fe7f395 ignores the provided DependencyType and uses DependencyType.JAR instead. Despite the JavaDoc correctly describing this behaviour, this is obviously not what was intended and would be a surprise to any developer using this constructor.
The potential impact of this bug seems small, given that most dependencies are actually JARs.