FOSSA CLI vs Expo

Releases arrive every one to three weeks and almost all of the substance is per-ecosystem dependency resolution. In this window: Node workspaces declared with a leading ./ now match, npm v3 lockfiles get target-level dependency scoping, pnpm lockfile handling was refactored, and sbt 1.4+ projects with an explicit DependencyTreePlugin route to the built-in command. Around that sit operational adjustments — the default scan timeout raised from 30 seconds to a minute, release-group project resolution moved to a server-side lookup — and two tags that carry nothing but a Themis version bump or a release cut.

The work is breadth-of-accuracy, not new features: every release closes a case where a real project layout produced an incomplete or wrong dependency graph. That is the correct shape for a compliance scanner, where a missed transitive dependency is a failed audit rather than a rough edge. The steady stream of package-manager-specific fixes suggests coverage is still being driven by customer projects that scan badly, which means the tail of ecosystems is long and being worked through one at a time.

Expect the pattern to continue with another package manager's lockfile format — the timeout increase hints scans are also getting slower on large monorepos, so performance work on the same paths is likely next.