FOSSA

No entries match these filters. Clear filters

1. announced Oct 29, 2026 · issue 127

   FOSSA adds Context-Aware Remediation, a fossabot-powered workflow that analyses application impact before merging dependency-upgrade PRs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   └──▷ HOW TO FIND IT
   When a security issue appears in FOSSA and the upgrade breaks the build, comment directly on the PR to have fossabot diagnose the CI failure and push a corrective commit.
   📍Steps: 1. Open the pull request that fossabot created for the security issue. 2. Review the impact-analysis comment fossabot posted, which lists what it checked. 3. If the build is red, comment @fossabot fix on the PR. 4. fossabot reads the CI failure output, generates a fix, and commits it to the PR branch.
   • Trigger context-aware dependency remediation by clicking Create PR on a security issue in FOSSA, which opens a pull request and runs an application impact analysis drawing on your test suites, interfaces, and CI signals.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • FOSSA now runs the same breaking-change analysis on PRs opened by Dependabot, Renovate, or Snyk, making existing auto-PR workflows context-aware without replacing them.
   • Context-Aware Remediation supports JS/TS, Python, and Java ecosystems via Quick Import from GitHub, with additional ecosystems coming.

   3 details in Everything

2. docs update Sep 23, 2026 · issue 083

   FOSSA adds scheduled and webhook-triggered project re-analysis, configurable under Settings → Projects → Hooks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Trigger an immediate FOSSA re-analysis from a CI pipeline after publishing a new package version.
   copy

   $ curl -X POST "https://app.fossa.com/hooks/webhook/sbom%2B58760%2Fmy-project"

   Enable organization-wide nightly re-analysis so license and vulnerability data stays current without manual intervention.
   📍In the FOSSA console, go to Settings → Projects → Hooks, enable Scheduled hooks, set Interval to day, Interval length to 1, and Time to 3:30pm.
   • Adds a POST https://app.fossa.com/hooks/webhook/{project-locator} endpoint to let external systems (CI pipelines, package registries) trigger on-demand FOSSA project re-analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds scheduled hooks to automatically re-analyze all organization projects on a recurring hour, day, or week interval at a configured time, enabled under Settings → Projects → Hooks.
   • Adds per-project webhook hooks configurable under Project Settings → Settings → Hooks, with automatic hook disabling and error recording when a project is ineligible for re-analysis.

   3 details in Everything

3. docs update Sep 23, 2026 · issue 083

   FOSSA exposes a public CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. Lookup API at analysis.fossa.com for querying CVEs and vulnerability metadata without a project scan.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Check a specific log4j version for all known CVEs, CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. scores, and EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. exploitation probability before importing it into a project.
   copy

   $ curl -X GET "https://analysis.fossa.com/api/v1/cpe/match/cpe%3A2.3%3Aa%3Aapache%3Alog4j%3A2.14.1%3A*%3A*%3A*%3A*%3A*%3A*%3A*?reverse-wildcard=true" -H 'accept: application/json'

   Quickly retrieve only CVE IDs for multiple components in one batch call to triage a dependency list in CI without fetching full metadata.
   copy

   $ curl -g "https://analysis.fossa.com/api/v1/cpe/match/%5B%22cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*%22,%22cpe:2.3:a:microsoft:internet_explorer:8.0.6001:beta:*:*:*:*:*:*%22%5D/id" -H 'accept: application/json'

   • Adds GET https://analysis.fossa.com/api/v1/cpe/match/{search} to return full security metadata — CVE IDs, CVSS v2/v3/v4 vectors, EPSS scores, CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes., affected packages, exploitability, and known ransomware campaign use — for any CPE v2.3 string, with no FOSSA account required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds GET https://analysis.fossa.com/api/v1/cpe/match/{search}/id to return only a lightweight list of vulnerability IDs (e.g. CVE identifiers) matching a CPE, avoiding the overhead of the full metadata response.
   • Adds GET https://analysis.fossa.com/api/v1/cpe/match/{search}/compat as a compatibility endpoint for clients previously using vulns.fossa.com/api/vulns/cpes/search, returning a simplified response with nvdId, cpe, affectedVersionRanges, and affectedPackageRanges.
   • Adds reverse-wildcard=true query parameter to all three CPE endpoints, enabling bidirectional CPE matching so database entries with wildcards in concrete-value fields are also returned.
   • Supports batch CPE lookup across all three endpoints by passing a JSON array of up to 20 CPE strings in the search path parameter; requests exceeding 20 strings are rejected with an error.

   +1 more show less

   • Exposes an interactive RapiDoc Viewer and Swagger UI at analysis.fossa.com for exploring and testing all CPE lookup endpoints directly in the browser without writing code.

   6 details in Everything