v3.6.0

Promote C/C++ features to general availability (#1087).

• --experimental-enable-vsi is now --detect-vendored.
• --experimental-analyze-dynamic-deps is now --detect-dynamic.

v3.5.3

• Manual Dependencies: Linux Dependencies (rpm-generic, apk, deb) can be provided as reference dependencies in fossa-deps file (#1086).

v3.5.2

Container Scanning: Fixes an issue with base64 encoded raw authentications (#1085).

v3.5.1

• Contributor counting: update the contributor count range from 90 days to 365 days. (#1083)

v3.5.0

Container Scanning: Uses native container scanner, deprecates old container scanner (#1078), (#1079), (#1080), (#1082).

With this release,

• container scanning analyzes projects for applications (npm, pip, etc) dependencies.
• container scanning can filter specific targets via target exclusions using fossa configuration file.
• fossa-cli's windows binary can perform container scanning.
• container scanned projects will show origin path in FOSSA web UI.
• container scanned projects can target specific architecture via digest.

You can use --only-system-deps flag to only scan for dependencies from apk, dpkg, dpm. This will mimic behaviour of older FOSSA CLI's container scanning (older than v3.5.0).

Learn more:

• container scanner
• fossa container analyze

If you experience any issues with this release or have questions, please contact FOSSA Support.

v3.4.11

• Npm (Lockfile v3) - Fixes a defect where, sometimes wrong version of the dependency was reported if multiple version of the same dependency existed in the lock file. (#1075)
• Npm (Lockfile v2) - Fixes a defect where, sometimes wrong version of the dependency was reported if multiple version of the same dependency existed in the lock file. (#1075)

v3.4.10

Scala: Supports analysis of multi-project sbt builds with sbt-dependency-graph plugin. (#1074).

v3.4.9

• Scan Summary: Identifies project skipped due to production path filtering, or exclusion filtering. (#1071)
• R: Adds support for renv package manager. (#1062)

v3.4.8

• Report: Fixes a defect where the report command failed due to an invalid dependencies cache. This fix only applies to endpoints with FOSSA v4.2.24 or above. (#1068).

v3.4.7

• Linux releases are now packaged as both tar.gz and zip to improve compatibility when installing (#1066)