LoginSign Up
← Back to all sparks
F

FOSSA CLI

INFRA · APIS
Velocity2.5

Dependency analysis and license compliance scanner for CI pipelines

fossa.com ↗

fossa-cli's feed jumps from 3.17 to 3.20, with clearer container scan errors.

dependency-scanningcontainer-scanninglockfilespackage-managerstelemetry
◆Current state
The newest entry, v3.20.10 (2026-10-31), makes container analysis report the registry error when an image layer fails to download instead of an internal threading error, and adds per-phase timing to analysis telemetry. The feed has no entries between 3.17.17 in August and 3.20.10, so the 3.18 to 3.20 releases are not visible here.
◆Where it's heading
The visible releases are ecosystem-by-ecosystem accuracy fixes (npm, pnpm, sbt, Conan, dpkg) and operational adjustments such as a longer default timeout. With three minor versions missing from the feed, any larger changes in that span can't be assessed from these entries.
◆Prediction
Expect more per-ecosystem resolution fixes and patch releases; the gap in the feed makes a more specific prediction unreliable.

◆Recent moves

  1. 6d ago

    Clearer container layer errors and phase timing telemetry

    Container scans now surface the real registry error when a layer can't be downloaded, and analysis telemetry records phase timings. Useful diagnostics, but small.

    View source ↗
  2. 2mo ago

    fossa-cli 3.17.17 bumps Themis to 1.0.69

    A single Themis bump to 1.0.69 and nothing else. It is the maintenance floor of this release stream rather than a change to how anything scans.

    View source ↗
  3. 3mo ago

    fossa-cli 3.17.16 raises the default timeout to one minute

    The default timeout moves from 30 seconds to a minute. A small operational tweak, though it hints that scans on larger projects were being cut short.

    View source ↗
  4. 3mo ago

    fossa-cli 3.17.15 fixes Node workspace and npm v3 lockfile scoping

    Node workspaces declared with a leading ./ are now matched, and npm v3 lockfiles gain target-level dependency scoping. Both are the accuracy work this feed is built on: a workspace that fails to match is a set of dependencies missing from the audit.

    View source ↗
  5. 3mo ago

    v3.17.14

    A release cut with no accompanying changes. Nothing here affects scanning behavior.

    View source ↗
  6. 3mo ago

    fossa-cli 3.17.13 refactors pnpm lockfile handling

    A pnpm lockfile refactor plus release-group project resolution moved to a server-side lookup. The pnpm work is the same per-ecosystem repair pattern; the release-group change shifts a resolution step off the client.

    View source ↗