LoginSign Up
← Back to all sparks
F

FOSSA CLI

INFRA · APIS
Velocity5.0

Dependency analysis and license compliance scanner for CI pipelines

fossa.com ↗

Ecosystem-by-ecosystem parser coverage is the whole roadmap.

dependency-scanningsbompackage-managerscontainer-scanningparser-coveragelicense-compliance
◆Current state
fossa-cli releases every one to two weeks, and nearly every change is about correctly reading one more package manager's metadata. In this window alone: pnpm lockfile handling refactored, npm v3 lockfiles taught target-level dependency scoping, Node workspaces matched when declared with a leading ./, sbt 1.4+ routed through DependencyTreePlugin, Conan list-valued licenses handled, and container scanning extended to /var/lib/dpkg/status.d.
◆Where it's heading
This is the unglamorous core of dependency scanning: correctness depends on parsing every ecosystem's format exactly, and every ecosystem keeps changing its format. The work arrives as many small, ticket-tracked strategy fixes rather than architectural change, and it comes from a mix of regular maintainers and first-time contributors. Some releases exist only to cut a version.
◆Prediction
Expect the same cadence of per-ecosystem parser fixes to continue, since that is what every release in this window consists of; nothing in the entries points to a structural change in how strategies are implemented.

◆Recent moves

  1. 3d ago

    fossa-cli 3.17.16 raises the default timeout to one minute

    Raises the default timeout from 30 seconds to one minute. A single-line change, released on its own.

    View source ↗
  2. 11d ago

    fossa-cli 3.17.15 fixes Node workspace and npm v3 lockfile scoping

    Two parser corrections in the JavaScript ecosystem: Node workspaces declared with a leading ./ now match, and npm v3 lockfiles gain target-level dependency scoping. Exactly the kind of format-detail fix that determines whether a scan is accurate.

    View source ↗
  3. 15d ago

    v3.17.14

    Contains only the release-cutting commit. A version tag with no accompanying change.

    View source ↗
  4. 21d ago

    fossa-cli 3.17.13 refactors pnpm lockfile handling

    Refactors pnpm lockfile handling and moves release-group project resolution to a server-side lookup. The pnpm work continues the JavaScript-ecosystem thread running through several releases here.

    View source ↗
  5. 1mo ago

    fossa-cli 3.17.12 routes sbt 1.4+ via DependencyTreePlugin

    Routes sbt 1.4 and later through the built-in DependencyTreePlugin command rather than the previous path, extending accurate Scala resolution to modern sbt versions. The remaining changes are repository housekeeping.

    View source ↗
  6. 1mo ago

    fossa-cli 3.17.11 scans dpkg status.d and fixes Conan licenses

    Three coverage fixes across unrelated ecosystems: Conan manifests with list-valued licenses, non-printable characters stripped from locators, and container scanning extended to the /var/lib/dpkg/status.d directory used by distroless-style images. Also marks a first-time contributor.

    View source ↗