- Go: Fixes a regression, where deep dependencies were reported as direct dependencies. (#443)
- Perl: Adds support for Perl with parsing of
META.json,META.yml,MYMETA.yml,MYMETA.json. (#428)
- Resolves a regression when parsing npm
package-lock.jsonfiles that do not contain aversionfield (#445)
- Special cases scans with a single VSI only filter to skip other analysis strategies (#407)
- Adds the ability to skip resolving dependencies from FOSSA projects discovered during VSI scans (#435)
- Fixes an issue observed during VSI analysis where fingerprinting files with lines longer than 64KiB would fail. (#427)
- Adds experimental capability for filtering gradle configuration for analysis. (#425)
Refer to: Gradle documentation for more details.
- Removes
fossa compatibilitycommand. (#383)
Use fossa-deps.{yml,json} file to facilitate archive uploading capability, previously provided by fossa compatibility command.
- Adds
--configflag, which can set custom path for configuration file. If--configflag is not used, base directory will scanned for.fossa.ymlfile. (#415)
- Fixes an issue where nodeJS errors were reported when no NodeJS project were discovered. (#424)
- Adds support for
fossa analyze --include-unused-deps, which prevents filtering out non-production dependencies. (#412) - Yarn: Adds support for workspaces. (#374)
- Npm: Adds support for workspaces. (#374)
- Npm: Removes unreliable
npm ls-based analysis tactic. (#374) fossa-deps: Adds support forbower-type inreferenced-dependencies. (#406)- Monorepo: Chunk AOSP files when uploading (#421).
- Monorepo: Don't fail on files that are filtered during expansion (#421).
- Monorepo: Send error state to UI if the CLI crashes, so scans won't appear to hang forever. (#409)
- Monorepo: Fix parsing nomos output bug where files contain newlines. (#409)
- Improves performance in scenarios where cgroups are used to limit the amount of CPU time available, such as K8S containers (#403)
- Monorepo: adds some optimizations to reduce the amount of file buffering in memory during a scan, resulting in less memory pressure and faster scans. (#402)
- Adds compatibility script for
fossa report attribution --json(#397)
- Fortran: Supports fortran package manager. (#377)
- Adds support for reporting origin path for binaries discovered via
--experimental-enable-binary-discovery(#396)
- When running
fossa analyzewith the--debugflag, we now create afossa.debug.json.gzfile containing detailed runtime traces for project discovery and dependency analysis
- Monorepo: Adds automatic retries to failed API calls. (#392)
- Adds JSON Output for
fossa test --jsonwhen there are no issues. (#387)
- Monorepo: Fixes bug with symlink logic mismatch between walker and buildspec uploader. (#388)
- Monorepo: Fixes bug with non-glob exclusions. (#386)
- Monorepo: Fixes crash when there are no ninja/buildspec files to upload. (#385)
- Monorepo: Fixes issue with only-path/exclude-path globs.
- Gradle: Supports analysis of projects using gralde v3.3 or below. (#370)
- Swift: Supports dependencies analysis for dependencies managed by Swift Package Manager. (#354)
- Leiningen: Executes
lein --versionbefore performing any analysis, to ensure Leiningen has performed its install tasks (done on its first invocation). (#379)
- Maven: Fixes
mvn:dependencytactic to exclude root project as direct dependency. (#375)
- Adds branch and revision information to the URL reported at the end of a
fossa analyze --experimental-enable-monoreposcan. (#378)
- When using
--experimental-enable-binary-discovery, prepopulates information discovered in JAR manfiests. (#372)
- Yarn: Fixes potential runtime errors, when yarn.lock contains deep dependency without specification at root level in yarn.lock. (#369)
- Fixes an issue with
fossa-deps.ymlvendored-dependenciesentries where uploads would fail if the dependency was in a subdirectory. (#373)
- Monorepo: Speeds up commercial phrase detection by doing a first pass before trying to parse context. (#371)
- Gradle: Classifies dependency from
testCompileClasspathandtestRuntimeClasspathconfigurations as test dependencies. (#366)
- Yarn: Analyzes yarn.lock without runtime error, when yarn.lock includes symlinked package. (#363)
- Monorepo: Efficiently upload binary blobs for ninja & buildspec files (#362).
- Yarn: Fixes missing dependency from the analyses, when dependency has zero deep dependencies, and is not a deep dependency of any other dependency. (#359)
Adds another closed beta feature around FOSSA C/C++ support. For now this functionality is considered publicly undocumented, and is only used with support from FOSSA engineering.
- Adds support for reporting detected binaries as unlicensed dependencies (#353)
- Yarn: Analyzes yarn.lock without runtime error, when yarn.lock includes directory dependency. (#361)
- Gradle: Classifies dependency's environment correctly, when originating from common android development and test configurations. (#338)
- Monorepo: Ignore permission errors when searching for ninja or buildspec files. (#351)
- CocoaPods: Supports git sources in
Podfile.lockanalysis. (#345)
fossa analyze --experimental-enable-monoreponow turns off proprietary language scanning by default, and has this feature controlled by a feature flag (#343)
- Resolves an issue where errors running
fossa reportandfossa testwould be made more confusing when the project isn't a monorepo project (#321) - Prevents uploading standard analysis results to monorepo projects, where they'd be silently ignored (#341)
- CocoaPods: Fixes
Podfile.lockparsing. It safely parses when Pod and Dependencies entries are enclosed with quotations. (#337)
- Fixes an issue where
--jsonwould output the raw project ID, instead of a normalized ID (#339)
- Gradle: Search parent directories for gradlew and gradlew.bat (#336)
This release also adds a number of closed beta features around FOSSA C/C++ support. For now this functionality is considered publicly undocumented, and is only used with support from FOSSA engineering.
As such this new functionality is hidden from the help and other documentation in this repo. For questions using the new functionality in this release please contact us!
- Support linking user-defined dependency binaries. (#323)
- Support resolving linked user-defined binaries found in projects when VSI is enabled. (#328)
- Support linking user project binaries. (#333)
- Support resolving linked user project binaries found in projects when VSI is enabled. (#333)
- Resolve a scan performance regression for
fossa vpsinvocations. (#335) - Resolve a scan performance regression for
fossa analyze --experimental-enable-monorepoinvocations. (#335)
- Maven: Fixes an issue where dependencies parsed from
dependency:treewould fail to resolve when uploaded. (#332)
- Maven: Fixes an issue where dependencies with a platform specifier were not correctly parsed. (#329)
- Dart: Adds support for pub package manager. (#313)
- Analyzed dependencies now report what file they were found in. (#316)
- Maven: Fixes an issue where projects with
settings.xmlfiles would not be analyzed correctly using thedependency:treetactic. (#327)
- Gradle: Fixes an issue where all dependencies would appear as direct. (#319)
- Monorepo: archive expansion now respects
--exclude-pathand--only-path. (#320)
- Maven:
mvn dependency:treenow correctly cleans up temporary files after an exception, and correctly usessettings.xmlwhen available. (#318)
- Expanded proprietary language snippets in monorepo scans. (#317)
- Adds support for a new Maven tactic that produces the full dependency graph if
mvn dependency:treeis available but the plugin is not. (#310)
- Elixir: Adds support for Elixir projects using
mix. (#287)
- Gradle: Fixes an issue where unresolvable Gradle configurations would cause Gradle analysis to show no dependencies (#292).
- Python: Fixes an issue where older Poetry lockfiles were not correctly identified. (#309)
- VPS: Adds
--exclude-pathand--only-pathto monorepo functionality infossa analyze. (#291) - VPS: Support globs in
--{exclude,only}-pathflags. (#291)
- Python: Adds support for the Poetry package manager. (#300)
- Perl: Adds support for CPAN dependencies in
fossa-deps. (#296)
- Adds support for selecting which folders analysis targets are discovered in. (#273)
- VPS: Adds support for
fossa testandfossa reportfor monorepo projects. (#290) - Maven: Adds support for
${property}substitution for<groupId>and<artifactId>fields in dependencies. (#282)
- Adds support for specifying a release group on project creation. (#283)
- Adds support for non-HTTPS backends for archive uploads (e.g. for on-premises deployments). (#276)
- Adds
--experimental-enable-monorepoand other associated flags tofossa analyze, which enables experimental monorepo support. (#286) - Deprecates
fossa vpssubcommands. (#286)
- Fixes an issue where some
fossacommands (includingfossa test) would exit non-zero on success. (#278).
- Fixes an issue where
fossa container analyzeexited zero on failure. (#275)
- Adds support for short flags. (#264)
- Adds a
remote-dependenciessection in thefossa-depsfile to support archives at specific URLs. (#260) - Renames some fields for
custom-dependenciesto avoid confusion. (#260)
- Adds JSON-formatted project information to the output of
fossa analyzewith--json. (#255)
- VPS: Bump wiggins - Updated
vps aosp-notice-filesubcommand to upload ninja files & trigger async task. (#272)
- Fixes an issue where stdout doesn't always flush to the console. (#265)
- Fixes an issue when referenced-dependencies are not being uploaded. (#262)
- Adds support for
fossa-deps.json. (#261) - Adds support for
vendored-dependenciesto be license scanned. (#257)
- Adds support for
--branchflag onfossa container analyzecommand. (#253) - Adds support and documentation for user-defined dependencies. (#245)
- Allows using
.ymlor.yamlextensions forfossa-depsfile, but not both. (#245) fossa analyzenow checksfossa-depsbefore running analysis (instead of checking in parallel with other analyses). (#245)
- VSI: Updates the VSI Plugin.
- VSI: Adds support for VSI powered dependency discovery as a strategy.
- Re-enables status messages for commands like
fossa testin non-ANSI environments. (#248) - Yarn: Adds support for Yarn v2 lockfiles. (#244)
- NuGet: Fixes the dependency version parser for
.csproj,.vbproj, and similar .NET files. (#247)
- Conda: Adds support for the Conda package manager. (#226)
- VPS: Adds
--followto thevps analyzesubcommand, which allows for following symbolic links during VPS scans. (#243)
- Display the progress of
fossa analyzewhile running. (#239)
- NPM: Fixes issue where transitive dependencies could be missing in NPM projects. (#240)
- Containers: Fixes an issue where
--projectand--revisionwere not correctly handled infossa container analyze. (#238)
- Adds support for
fossa-deps.yml. (#236)
- Python: Fixes an issue where parsing unsupported fields in
requirements.txtcould prevent Python analyses from terminating. (#235)
- Go: Upload module identifiers instead of package identifiers to the backend. (#234)
- VPS: Update VPS plugin to
2021-04-27-312bbe8. (#233)- Improve performance of scanning projects
- Reduce memory pressure when scanning large projects
- VPS: Update VPS plugin to
2021-04-19-9162a26. (#231)
- Only activate replay/record mode using
--replay/--record(previously it was turned on in--debugmode). (#212) - Containers: Fixed a bug where container scanning failed when ignored artifacts aren't in the right shape. (#223)
- VPS: Update the VPS scanning plugin:
- Resolve issues reading IPR files with null byte content.
- Workaround recursive variable declarations when parsing Android.mk files.
- VPS: Support makefiles in
fossa vps aosp-notice-file. (#216) - VPS: Require paths to ninja files as arguments in
fossa vps aosp-notice-file. (#217)
- VPS: Print project URL after
fossa vps analyze. (#215)
- Gradle: Fixes an issue that sometimes prevented Gradle project analyses from terminating. (#211)
- PHP: Fixes an issue where Composer lockfiles could cause a crash when parsing. (#207)
- Scala: Fixes an issue that sometimes prevented Scala analyses from terminating. (#206)
- Containers: Add container analysis toolchain. (#173)
- Python: Fixes an issue with
requirements.txtparsing line extensions. (#183) - Fixes an issue where we didn't read the cached revision when picking a revision for
fossa testin projects without VCS. (#182) - Fixes an issue where invalid project URLs would be printed for projects without VCS when
--branchwas not specified. (#181)
- Introduce a new hidden
fossa compatibilitycommand which runs fossa v1fossa analyzeand allows users to access the archive uploader. (#179)
- Fixes an issue where
fossa testwould always exit zero for push-only API keys. (#170) - Fixes an issue where dependency graphs would be filtered out if they had no direct dependencies (e.g. in strategies like Yarn where direct dependencies are unknown). (#172)
- Go: Fixes an issue with
glide.lockparser. (#175) - Go: Adds multi-module project support to
go.modstatic analysis. (#171) - NPM, Yarn: Fixes an issue where subdirectories were erroneously ignored. (#174)
- VPS: Update Wiggins CLI plugin to version
2020-12-11-5d581ea
- VPS: Update
fossa vps analyzeto use a new VPS project scanning engine:- Improve scan performance
- Support "License Only" scans, where the project is scanned for licenses but is not inspected for vendored dependencies.
- Maven: Add limited support for POM
${property}interpolation. (#158)
- Adds
--versionflag. (#157)
- RPM: Adds support for unpacking of gzipped RPMs. (#154)
- VPS: Integrates
vpscli scanasfossa vps analyze. (#148) - VPS: Removes
vpsclibinary. (#148) - VPS: Adds support for
--teamand other metadata flags to VPS analysis. (#149) - VPS: Adds
fossa vps testcommand, analogous tofossa testfor VPS projects. (#150) - VPS: Adds
fossa vps reportcommand, analogous tofossa reportfor VPS projects. (#150)
- Adds
fossa list-targetsto list "analysis targets" (projects and subprojects) available for analysis. (#140) - Adds
--filter TARGEToption tofossa analyze. (#140) - Adds support for "detached HEAD" state in
gitandsvn. (#141) - Python: Dependencies found via
*req*.txtandsetup.pyare now merged. (#140) - Maven: Natively support multi-POM Maven projects. (#140)
- Gradle: Fixes an issue where subprojects were not handled correctly. (#140)
- RPM: Dependencies from multiple
*.specfiles in the same directory are now merged. (#138) - Erlang: Aliased packages in
rebar3are now resolved to their true names. (#139) - Gradle: Support all build configurations (instead of a hard-coded list of known configuration names). (#134)
- Erlang: Fixes an issue where the
rebar3strategy would incorrectly identify dependencies as top-level projects. (#119) - Python: Fixes various issues in the
setup.pyparser. (#119) - Haskell: Adds support for Haskell projects using
cabal-install. (#122) - PHP: Adds support for PHP projects using
composer. (#121)
- Scala: Adds support for Scala projects using
sbt. (#54)
- Python: Fixes an issue where the
req.txtstrategy would run even when no relevant files were present. (#109)
- Improves contributor counting accuracy using repository metadata. (#94)
- Improves parallelism of strategy discovery. (#93)
- Fixes an issue where URLs printed by
fossa testand other commands were incorrect forgitprojects withhttpsremotes. (#92) - Fixes an issue where
IOExceptions (like "command not found") would cause strategies to crash. (#106) - Fixes an issue where with effect typechecking. (#100)
- Python: Dependencies of multiple
*req*.txtfiles in a single project are now merged. (#102) - Go: Re-enables deep dependency reporting (which was previously disabled for development purposes). (#98)
- NuGet: Adds support for analyzing
paket.lockfiles. (#107)