v3.7.2

License Scanning: Add four new licenses: Pushwoosh, PalletsFlaskLogo, IntelDisclaimer and Instabug

v3.7.1

Stack: Git based dependencies are detected and handled correctly. (#1160)

v3.7.0

Adds support for the concept of "user-provided analysis commands" to the CLI. These can be specified as environment variables for strategies which support them. The first such strategy is Maven; see the Maven strategy documentation for more details.

Additionally:

• Support Maven wrapper (mvnw / mvnw.bat) usage in Maven projects (#1149).
• Installation Script: Verify that the sha256sum of the downloaded archive matches the recorded one (#1158).

v3.6.18

• License Scanning: Emit a warning if unarchiving fails rather than a fatal error. (#1153)

v3.6.17

• fossa test: Display CVE, fixed version information, and issue dashboard links when possible. (#1146)

v3.6.15

• Container scanning: support more tar formats. (1142)
• --detect-dynamic: Supports recursively inspecting binaries for dynamic dependencies. (#1143)

v3.6.14

Fossa Test: Improved reporting from fossa test. (#1135)

v3.6.13

• Vendored Dependencies: Add the unity companion license (https://unity.com/legal/licenses/unity-companion-license) and unity package distribution license (https://unity.com/legal/licenses/unity-package-distribution-license) to license scanning (#1136)

v3.6.12

Maven: If a package is both "test" and "compile", it is no longer filtered (#1138).

v3.6.11

• Lib yarn protocol: When we encounter Yarn lib deps we should warn but not fail the scan (#1134)