What's Changed

• [ANE-Bot] Stop warning about missing setup.py in requirements.txt-only projects by @fossa-ane-bot in #1749
• Handle traits argument in Swift package dependencies by @tjugdev in #1746
• [ANE-Bot] Tolerate package-lock.json without a dependencies key by @fossa-ane-bot in #1753
• [ANE-Bot] Support pnpm v11 multi-document pnpm-lock.yaml by @fossa-ane-bot in #1754
• [ANE-1349] Binary discovery support for whl files by @GauravB159 in #1750
• [ANE-1350] Binary discovery support for nupkg files by @GauravB159 in #1751

Full Changelog: v3.18.0...v3.18.1

• Container scanning: fossa container analyze now reports Go module dependencies embedded in Go binaries (built with Go >= 1.18) found in container image layers as regular Go dependencies, supporting images without package manager metadata such as scratch and distroless images (#1740)
• Bun: Dependencies reachable only through a devDependencies entry are now reported as development dependencies instead of production dependencies.
• Analysis: JSON manifest files with a leading UTF-8 byte order mark (commonly written by Windows tooling, e.g. in NuGet project.json) no longer fail to parse.
• NuGet: project.json files that are not NuGet manifests (e.g. Nx project configuration) are no longer claimed by the NuGet analyzer, so they no longer fail analysis with key "dependencies" not found.
• NuGet: project.json manifests may omit the top-level dependencies key.
• NuGet: project.json dependencies declared per-framework under frameworks are now reported.

What's Changed

• Bump Themis for version 1.0.69 by @spatten in #1742

Full Changelog: v3.17.16...v3.17.17

What's Changed

• Change timeout from default 30s to 1 minute by @GauravB159 in #1738

Full Changelog: v3.17.15...v3.17.16

What's Changed

• [ANE-3057] Match Node workspaces declared with a leading ./ by @nficca in #1733
• Npm: support target-level dependency scoping for v3 lockfiles by @zlav in #1732
• Cut release 3.17.15 by @nficca in #1735

Full Changelog: v3.17.14...v3.17.15

What's Changed

• Cut release 3.17.14 by @nficca in #1731

Full Changelog: v3.17.13...v3.17.14

What's Changed

• Pnpm lock refactor by @csasarak in #1725
• Bump version for themis v1.0.58 by @zlav in #1729
• Release groups: resolve add-projects target via server-side lookup (CORE-7241) by @lackstein in #1728

Full Changelog: v3.17.12...v3.17.13

What's Changed

• Add workflow to close stale issues by @tjugdev in #1722
• Strategy/Scala: route sbt 1.4+ with explicit DependencyTreePlugin to built-in command (TKT-15490) by @zlav in #1711
• Remove hlint ignore now fix has merged by @nficca in #1726
• Cut release 3.17.12 by @nficca in #1727

Full Changelog: v3.17.11...v3.17.12

What's Changed

• docs(conan): handle list-valued license in make_fossa_deps_conan by @cmboling in #1719
• Strip non printable characters from locators by @tjugdev in #1720
• [Container Scanning] Support scanning /var/lib/dpkg/status.d directory by @GauravB159 in #1721

New Contributors

• @GauravB159 made their first contribution in #1721

Full Changelog: v3.17.10...v3.17.11