• nodejs: Fix a bug where cycles involved peer dependencies would cause an infinite loop. (#870)
• Experimental: Allow local license scanning of vendored dependencies (specified in fossa-deps.yml file) when using --experimental-native-license-scan.
  • #868
  • #858
  • #838
  • #814
  • #873

• Experimental: native license scanning is now disabled by default. (#865)

• Telemetry: Introduces fossa cli telemetry for fatal errors and warnings. By default, telemetry is disabled (#831).

Please read for more details on telemetry: https://github.com/fossas/fossa-cli/blob/master/docs/telemetry.md

• Configuration: Fixes a bug where .fossa.yml was picked up only in the working directory, not in the analysis directory (#854).
• Configuration: Reports an error when provided API key is an empty string (#856).

• Windows: Fixes a --version command for windows release binary. (#857)

• Configuration: Users can now use .fossa.yaml as a configuration file name. Previously, only .fossa.yml was supported. (#851)
• fossa-deps: Fixes an archive uploading bug for vendor dependency by queuing archive builds individually. (#826)
• nodejs: Capture peer dependencies transitively for npm package-lock.json files. (#849)

• Respects Go module replacement directives in the Go Mod Graph strategy. (#841)

• Adds --format to fossa report attribution and deprecates --json. (#844)
  • Supported format options: spdx, markdown, json.

• Handles symlink loops in directory structure. (#827)
• No longer crashes when fossa-deps.yml exists but has an empty archived-dependencies property. (#832)

• Adds support for identifying dynamically linked dependencies in an output binary. (#818, #788, #780, #788, #771, #770)

Documentation for this experimental feature may be found here: Dynamic Linked Dependency Detection.

• Fixes a bug which ignored the server field in the config file. (#821)