fossa-cli: download ældre versioner

• Container scanning：blob digests in an image manifest fetched from a registry are validated against the OCI digest format before they name files in the export directory.
• Poetry：`poetry.lock` files whose `[package.dependencies]` entries point at a path, git or URL dependency (e.g. `lamipy = {path = "../lamipy", develop = true}`, which have no `version` key) no longer fail analysis with `missing key: version in package[N].dependencies.<name>`. ([#1805](https://github.com/fossas/fossa-cli/pull/1805))

• VSI：`paths.only` and path globs now apply to `--detect-vendored`. ([#1812](https://github.com/fossas/fossa-cli/pull/1812))
• Go：`fossa analyze` can now report dependencies from the module list embedded in compiled Go binaries (Go >= 1.18), for Go code shipped with no `go.mod`. Opt in with `--enable-go-binary-analysis`; add `--unpack-archives` to reach binaries inside archives such as an AAR. ([#1757](https://github.com/fossas/fossa-cli/pull/1757))

• Pnpm：Union multi-document workspace dependency graphs. ([#1796](https://github.com/fossas/fossa-cli/pull/1796))
• FOSSA API：name the proxy when a stripped `Authorization` header lands on a sign-in page. ([#1808](https://github.com/fossas/fossa-cli/pull/1808))

• Composer：platform requirements in `composer.lock` (`php`, `php-*`, `hhvm`, `ext-*`, `lib-*`, `composer`, `composer-plugin-api` and `composer-runtime-api`) are no longer reported as versionless dependencies such as `comp+ext-mbstring$`. ([#1799](https://github.com/fossas/fossa-cli/pull/1799))
• NuGet：a `.csproj` (or other project file) is no longer analyzed when `obj/project.assets.json` exists beside it to avoid analyzing projects twice
• NuGet：`PackageVersion` entries in `Directory.Packages.props` whose `Version` references an MSBuild property are now expanded.

• Vendored Dependencies and Snippet Scanning：Fix a bug that caused snippet scanning and vendored dependency scanning to scan hidden and gitignore files ([#1801](https://github.com/fossas/fossa-cli/pull/1801))
• Swift：`Package.swift` manifests that build `dependencies` or other `Package(...)` arguments in code (e.g. `dependencies: deps`) no longer fail analysis. ([#1800](https://github.com/fossas/fossa-cli/pull/1800))

## What's Changed
• [ANE-Bot] Make Gradle init script work with the configuration cache by @fossa-ane-bot in https://github.com/fossas/fossa-cli/pull/1790
• [ANE-Bot] Accept Gopkg.lock/Gopkg.toml with no dependencies by @fossa-ane-bot in https://github.com/fossas/fossa-cli/pull/1791
• [ANE-3140] Adapt the Conan strategy in the CLI to emit native Conan source units by @GauravB159 in https://github.com/fossas/fossa-cli/pull/1775
• [ANE-3140] Update Conan docs by @GauravB159 in https://github.com/fossas/fossa-cli/pull/1792

**Full Changelog**：https://github.com/fossas/fossa-cli/compare/v3.19.3...v3.20.0

## What's Changed
• Cut release 3.19.3 by @nficca in https://github.com/fossas/fossa-cli/pull/1789

**Full Changelog**：https://github.com/fossas/fossa-cli/compare/v3.19.2...v3.19.3

## What's Changed
• Poetry：`pyproject.toml` files with a `[tool.poetry.dependencies]` entry that has no version, git, path or url (e.g. a source-only `pkg = { source = "private" }` that adds settings to a dependency declared in PEP 621 `[project].dependencies`) no longer fail analysis. (https://github.com/fossas/fossa-cli/pull/1784)
• uv：`uv.lock` files that lock more than one version of a package (e.g. different versions for different Python versions) now report every version under the package that depends on it. Previously only one version was kept, and the other versions' dependencies were reported as direct dependencies. (https://github.com/fossas/fossa-cli/pull/1782)

**Full Changelog**：https://github.com/fossas/fossa-cli/compare/v3.19.0...v3.19.1

## What's Changed
• Maven：report declared dependencies as direct in static analysis by @csasarak in https://github.com/fossas/fossa-cli/pull/1770

**Full Changelog**：https://github.com/fossas/fossa-cli/compare/v3.18.3...v3.18.4

Container scanning: `fossa container analyze` now reports Go module dependencies embedded in Go binaries (built with Go >= 1.18) found in container image layers as regular Go dependencies, supporting images without package manager metadata such as `scratch` and distroless images ([#1740](https://github.com/fossas/fossa-cli/pull/1740))
Bun: Dependencies reachable only through a `devDependencies` entry are now reported as development dependencies instead of production dependencies.
Analysis: JSON manifest files with a leading UTF-8 byte order mark (commonly written by Windows tooling, e.g. in NuGet `project.json`) no longer fail to parse.
NuGet: `project.json` files that are not NuGet manifests (e.g. Nx project configuration) are no longer claimed by the NuGet analyzer, so they no longer fail analysis with `key "dependencies" not found`.
NuGet: `project.json` manifests may omit the top-level `dependencies` key.
NuGet: `project.json` dependencies declared per-framework under `frameworks` are now reported.

What's Changed
• Pnpm lock refactor by @csasarak in #1725
• Bump version for themis v1.0.58 by @zlav in #1729
• Release groups：resolve add-projects target via server-side lookup (CORE-7241) by @lackstein in #1728
Full Changelog：v3.17.12...v3.17.13

What's Changed
- Pnpm lock refactor by @csasarak in #1725
- Bump version for themis v1.0.58 by @zlav in #1729
- Release groups: resolve add-projects target via server-side lookup (CORE-7241) by @lackstein in #1728
Full Changelog: v3.17.12...v3.17.13

What's Changed
- Add workflow to close stale issues by @tjugdev in #1722
- Strategy/Scala: route sbt 1.4+ with explicit DependencyTreePlugin to built-in command (TKT-15490) by @zlav in #1711
- Remove hlint ignore now fix has merged by @nficca in #1726
- Cut release 3.17.12 by @nficca in #1727
Full Changelog: v3.17.11...v3.17.12

What's Changed
- docs(conan): handle list-valued license in make_fossa_deps_conan by @cmboling in #1719
- Strip non printable characters from locators by @tjugdev in #1720
- [Container Scanning] Support scanning /var/lib/dpkg/status.d directory by @GauravB159 in #1721
New Contributors
- @GauravB159 made their first contribution in #1721
Full Changelog: v3.17.10...v3.17.11

What's Changed
- Cargo: Fix transitive dev-dependency classification by @spatten in #1692
- Bump rustls-webpki to 0.103.13 to fix GHSA-82j2-j2ch-gfr8 and GHSA-965h-392x-2mh5 by @zlav in #1716
- Bump version for themis v1.0.54 by @nficca in #1717
Full Changelog: v3.17.8...v3.17.10

What's Changed
- [ANE-2955] Fix vendored archive uploads with absolute paths by @nficca in #1713
- Fix changelog by @nficca in #1715
Full Changelog: v3.17.7...v3.17.8

What's Changed
- [ANE-2523] NuGet: analyze every .csproj in a directory by @zlav in #1712
Full Changelog: v3.17.6...v3.17.7

- Config: paths.only and paths.exclude in .fossa.yml now accept glob patterns. (#1703)
- Licensing - Fix two bad GPL matches [No PR]

What's Changed
- [ANE-2724] Pass --debug to Ficus when CLI is in debug mode by @nficca in #1706
Full Changelog: v3.17.4...v3.17.5

What's Changed
- [ANE-2877] Support PEP 621 project.dependencies in Poetry 2.x strategy by @zlav in #1683
- [ANE-2908] Swift Package.swift parser improvements by @tjugdev in #1695
- [ANE-2809] Add NuGet Central Package Management (CPM) support by @zlav in #1694
Full Changelog: v3.17.1...v3.17.2

What's Changed
- [ANE-2900] Omit unset fields from project edit request body by @nficca in #1688
- [ANE-2655] Expose yarn and npm workspace packages as individual build targets by @jagonalez in #1643
- [ANE-2901] UV: Add directory source type to uv.lock parser by @zlav in #1691
Full Changelog: v3.17.0...v3.17.1

What's Changed
- [ANE-2886] Handle missing version field in uv.lock editable packages by @zlav in #1682
- add a comment about who has access to macos signing stuff by @spatten in #1681
- Gradle: Add additional development and test configurations for common plugins by @zlav and @jeffalder in #1685
- Vendetta: single-file and multi-location deps by @nficca in #1680
Full Changelog: v3.16.7...v3.17.0

- Cargo: Deal with git-backed cargo locators properly (#1670)

What's Changed
- Bump tar crate to 0.4.45 to fix CVE-2026-33055 and CVE-2026-33056 by @spatten in #1679
- [ANE-2795] Fix UTF-8 encoding for ficus output on Windows by @Conor-FOSSA in #1646
Full Changelog: v3.16.5...v3.16.6

- PNPM: Fix pnpm v9 lockfile transitive devDependency classification. Dependencies of devDependencies were incorrectly reported as production dependencies in pnpm v9 projects. (#1668)

Mac OS: Resolve an issue with dynamic linking on some Mac OS systems.

- Elixir: Use MIX_ENV=prod for accurate production dependency resolution, with fallback to --only prod for projects lacking config/prod.exs (#1662)
- Infrastructure: Add cmdEnvVars field to Command type for setting environment variables on subprocesses via typed-process (#1662)

- Conda: Make conda analysis work on versions of conda where the --force flag is deprecated for conda env create (#1661)
- Bug fix: fail early if the --output flag is combined with --snippet-scan or --x-vendetta flags (#1659)
- Hide deprecated --experimental-use-v3-go-resolver, --experimental-skip-vsi-graph and --experimental-link-project-binary flags, and deprecate the experimental-link-user-defined-dependency-binary subcommand. The flags and subcommand still work, but are no longer documented or shown in the help text (#1633)

- Licensing: Add standalone detection for Solace proprietary licenses (solace-software-2021, solace-non-production-1.0, solace-api-1.1) (#1660)
- Licensing: Add support for SPDX tag-value format license declarations

What's Changed
- add bun support by @jagonalez in #1648
- Cut release 3.16.0 by @nficca in #1650
Full Changelog: v3.15.9...v3.16.0

- Improvements for licensing and snippet scanning (#1649)
- Licensing: Additional proprietary license detection
- Snippet scanning: Support TLS operation with platform native certificate store

What's Changed
- Prep for release 3.15.8 by @spatten in #1645
Full Changelog: v3.15.7...v3.15.8

- PNPM: Fixes an issue where transitive dependencies with peer dependencies weren't detected in lockfile v6. (#1642)

- Docs: Document ALLOW_INVALID_CERTS environment variable for TLS certificate errors (#1639)
- Golang: Fix a bug where we did not correctly parse old-style go.mod files with quoted package names (#1636)
- Archive uploads: Fix a bug where tar files with long filenames created by GNU tar would not extract correctly (#1635)

- Scala fix: Prefer MiniDependencyTreePlugin over explicit DependencyTreePlugin (#1627).

- Remove fossa snippets subcommand and documentation (#1623).
The fossa snippets subcommand has been replaced by fossa analyze --snippet-scan (documentation). If you are still using fossa snippets, you can temporarily keep using it by using versions of the CLI previous to this release. We will eventually be sunsetting the services that back fossa snippets, but will keep them running to mid-February at the very earliest. Once those services stop running then fossa snippets will no longer work at all, even when using older versions of the CLI. Please reach out to support@fossa.com if you have any questions.
- Allow snippet scanning of binary files. This allows us to find exact matches for binary files. (No PR. This was implemented in a separate binary that does snippet scanning for us.)

What's Changed
- Cut release for themis 1.0.41 by @nficca in #1625
Full Changelog: v3.15.1...v3.15.2

A small tweak in format for output when using --x-vendetta

- Make snippet scanning non-experimental. This PR deprecates fossa analyze --x-snippet-scan. Please use fossa analyze --snippet-scan instead. (#1622)

- Add fork-aliasing. Use this if you are using a fork of a dependency, but want FOSSA to treat it as if you were using the base version that you forked from. (#1620)

What's Changed
- [ANE-2672] Add --x-vendetta flag by @nficca in #1607
Full Changelog: v3.13.1...v3.14.0

- Add a summary of the snippet scan when the --x-snippet-scan flag is used (#1613)
- Update snippet scanning documentation (#1615)

- Change how debug logs are generated. They are now generated in a file called fossa.debug.zip, which can contain multiple files. For the common case of fossa analyze --debug, it will now contain the debug bundle (fossa.debug.json) and the telemetry json (fossa.telemetry.json). It will also contain Ficus logs if Ficus is run via --x-snippet-scan (#1610)

What's Changed
- Cut release for themis update by @nficca in #1616
Full Changelog: v3.12.2...v3.12.3

- Update the latest version of a dependency for --x-snippet-scan. This update will start backfilling fingerprints for ~10% of files that were previously uploaded but do not have fingerprints (#1611)

- Update latest version of a dependency for --x-snippet-scan. This makes some changes to the data we send and store so that we can more easily update snippet data in the background (#1587)

- Python: Add support for projects using uv for package management (#1604)

- Allow empty go.mod files (#1596)
- Add new --exclude-manifest-strategies option (#1597)
- Remove reachability output from scan summary (#1598)
- Handle path dependencies in Cargo projects (#1599)
- Fix Cargo workspace members showing up as dependencies (#1600)
- Fix Pipenv projects reporting all dependencies as direct dependencies (#1601)
- Handle HTTP errors when fetching container image manifest (#1602)

- [Bug]The Ficus command was being constructed incorrectly if there were file exclusions in .fossa.yml (#1595)
- Update Ficus to fix a bug with Windows paths (No PR)

- Optimize snippet scanning for time and space.(#1591)
- Go - multi line godebug and tool settings are properly parsed (#1586)

- Get the snippet-scan-retention-days setting from an organization, and pass it into Ficus (#1586)

- Update latest version of a dependency for --x-snippet-scan. This change outputs errors from the snippet scanning CLI so that we can debug more easily (#1587)

- Update latest version of a dependency for --x-snippet-scan. This change makes snippet scanning more resilient to errors when POSTing fingerprints and hashes, and ignores the RUST_LOG environment variable (#1585)

- Update latest version of a dependency for --x-snippet-scan. This change fixes a bug where snippet scans with large fingerprints were failing (#1584)

- Remove spurious log message. (#1582)
- Update latest version of a dependency for --x-snippet-scan. This change will speed up scans (#1583)

What's Changed
- Update changelog by @james-fossa in #1579
Full Changelog: v3.11.2...v3.11.3

What's Changed
- Replace the BASIS token with an updated token by @zlav in #1572
- Update nix shell by @nficca in #1574
- [ANE-2484] Download ficus in vendor_download.sh by @james-fossa in #1565
Full Changelog: v3.10.14...v3.11.0

What's Changed
- gradle: exclude constraints when retrieving dependencies by @jagonalez in #1563
- [ane-2575] scan all layers for os info by @jagonalez in #1566
Full Changelog: v3.10.13...v3.10.14

What's Changed
- [ANE-1892] Adds dynamic severity output to fossa test by @gilfaizon in #1562
- [Docs-only] Improve Link Checking by @gilfaizon in #1557
- [Docs-only] Fix "Default Filters" link by @gilfaizon in #1536
Full Changelog: v3.10.12...v3.10.13

- PNPM: Initial support for lockfile version 9.0 (#1561)

What's Changed
- Make it clearer that our manual dependency support is not specific to GitHub by @csasarak in #1554
- Fix unzipping JARs that symlink to other layers by @zlav in #1555
- Update Documentation Links by @gilfaizon in #1556
- Add rendergraph to releases by @jssblck in #1558
Full Changelog: v3.10.10...v3.10.11

- go: support the tool directive introduced in go Feb 2025 (#1553)

- CLI Args: Add a --tee-output argument to allow uploading results and also printing them to stdout. (#1546)

- Custom license scans: Apply licenseScanPathFilters to custom license scans (#1535).

- Report: Allow generating SBOMs attribution reports using fossa-cli. (#1534)

- Licensing: Fix a bug where the scikit-learn had an incorrect license detected (#1527)
- Licensing: Adds support for the NREL disclaimer

Container scanning: Resolved a large number of issues with scanning containers (#1514, #1521)
- Pulling containers from recent versions of Docker are properly supported.
- OCI container hosts are better supported.
- Scanning exported containers from recent versions of Docker are properly supported.
- Authentication is better supported overall, it now integrates with native Docker authentication providers.
- The old container scanning functionality still exists in FOSSA CLI as a fallback if the new functionality fails.
Note
FOSSA built a separate binary to handle pulling images; refer to its repository for details.
This binary is bundled into FOSSA CLI, you don't need to do anything special to use it.

- Licensing: Adds support for Zeebe Community License v1.1 and Camunda License v1.0
- NuGet: Consolidate project.assets.json and PackageReference strategies (#1461)

- Maven: Fix hanging maven analysis #1381

- Reachability: Includes reachability analysis in scan summary #1379

- Update error structure #1364

- Reachability: Adds reachability analysis. Reachability analysis requires compatible FOSSA endpoint version, and will not upload reachability analysis, if endpoint does not have reachability compatibility. - Maven: Adds reachability analysis #1377
- Gradle: Adds reachability analysis #1377

--detect-dynamic: Safely ignores not found cases in ldd parsing. (

- Emits a warning instead of an error when no analysis targets are found (#1375)

- Add color and update formatting in cli help commands (#1367)