- Bun: when
bun.lockinstalls a package at more than one version, the extra versions (stored under nested keys like"express/path-to-regexp") are now reported, and their parents link to the correct version instead of the top-level one. (#1802) - Pnpm: preserve distinct peer-resolution snapshots during graph construction so all resolved peer versions and their dependency edges are retained, without mixing production and development environments between resolutions. (#1776)
- Pnpm:
optionalDependenciesare now read from the lockfile. A project's own optional dependencies are reported as direct dependencies instead of transitive ones, and a package's optional dependencies are connected to it in the graph instead of appearing as unrelated transitive dependencies. Platform packages such asfsevents,sharp's@img/*libraries, and the@esbuild/*binaries are the usual cases. (#1766) - Pnpm: workspace members are now individual build targets, so a single member can be analyzed on its own with
--only-target 'pnpm@./:my-package'or atarget:entry in.fossa.yml. Previously every member's dependencies were merged into one result with no way to scope them. Dependencies a selected member reaches through the workspace protocol (link:in the lockfile) are included. Scoped analysis preserves development-only workspace links and each member's resolved peer versions. Unfiltered analysis retains the whole workspace. (#1763) - Node: when a yarn, npm, or pnpm workspace root or member has no
namein itspackage.json, discovery now warns that no build targets can be offered for the workspace and that adding anameenables them. This also preserves unnamed members' dependencies during unfiltered analysis. (#1763) - Node: package.json-only analysis now resolves pnpm
catalog:references from the nearestpnpm-workspace.yaml, including scans started inside a workspace member. Catalog dependencies are reported with their declared versions or ranges. References that remain unresolved, and localworkspace:orlink:references, are skipped with a warning rather than reported at literal protocol strings as versions. (#1765)
Other Useful Business Software
Custom VMs From 1 to 96 vCPUs With 99.95% Uptime
Live migration and automatic failover keep workloads online through maintenance. One free e2-micro VM every month.
MongoDB Atlas runs apps anywhere
MongoDB Atlas gives you the freedom to build and run modern applications anywhere—across AWS, Azure, and Google Cloud. With global availability in over 115 regions, Atlas lets you deploy close to your users, meet compliance needs, and scale with confidence across any geography.
