LoginSign Up
← Back to all sparks
F

FOSSA CLI

INFRA · APIS
Velocity5.0

Dependency analysis and license compliance scanner for CI pipelines

fossa.com ↗

fossa-cli's releases are ecosystem-by-ecosystem repairs to how lockfiles are read.

dependency-scanninglockfilespackage-managerssca-accuracyrelease-cadence
◆Current state
Releases arrive every one to three weeks and almost all of the substance is per-ecosystem dependency resolution. In this window: Node workspaces declared with a leading ./ now match, npm v3 lockfiles get target-level dependency scoping, pnpm lockfile handling was refactored, and sbt 1.4+ projects with an explicit DependencyTreePlugin route to the built-in command. Around that sit operational adjustments — the default scan timeout raised from 30 seconds to a minute, release-group project resolution moved to a server-side lookup — and two tags that carry nothing but a Themis version bump or a release cut.
◆Where it's heading
The work is breadth-of-accuracy, not new features: every release closes a case where a real project layout produced an incomplete or wrong dependency graph. That is the correct shape for a compliance scanner, where a missed transitive dependency is a failed audit rather than a rough edge. The steady stream of package-manager-specific fixes suggests coverage is still being driven by customer projects that scan badly, which means the tail of ecosystems is long and being worked through one at a time.
◆Prediction
Expect the pattern to continue with another package manager's lockfile format — the timeout increase hints scans are also getting slower on large monorepos, so performance work on the same paths is likely next.

◆Recent moves

  1. 21d ago

    fossa-cli 3.17.17 bumps Themis to 1.0.69

    A single Themis bump to 1.0.69 and nothing else. It is the maintenance floor of this release stream rather than a change to how anything scans.

    View source ↗
  2. 1mo ago

    fossa-cli 3.17.16 raises the default timeout to one minute

    The default timeout moves from 30 seconds to a minute. A small operational tweak, though it hints that scans on larger projects were being cut short.

    View source ↗
  3. 1mo ago

    fossa-cli 3.17.15 fixes Node workspace and npm v3 lockfile scoping

    Node workspaces declared with a leading ./ are now matched, and npm v3 lockfiles gain target-level dependency scoping. Both are the accuracy work this feed is built on: a workspace that fails to match is a set of dependencies missing from the audit.

    View source ↗
  4. 1mo ago

    v3.17.14

    A release cut with no accompanying changes. Nothing here affects scanning behavior.

    View source ↗
  5. 2mo ago

    fossa-cli 3.17.13 refactors pnpm lockfile handling

    A pnpm lockfile refactor plus release-group project resolution moved to a server-side lookup. The pnpm work is the same per-ecosystem repair pattern; the release-group change shifts a resolution step off the client.

    View source ↗
  6. 2mo ago

    fossa-cli 3.17.12 routes sbt 1.4+ via DependencyTreePlugin

    Scala projects on sbt 1.4+ that declare DependencyTreePlugin explicitly now route to the built-in command. Another single-ecosystem correction, this time on the JVM side.

    View source ↗