Hi everyone. I've been evaluating FOSSA for my team's open source compliance, and I've hit something confusing.
I ran a scan on one of our projects, and it completely missed a library we're using that's licensed under AGPL-3.0. It's a pretty direct import in our package.json (we're a Node.js shop). I double-checked the dependency tree, and it's definitely there.
Has this happened to anyone else? I thought FOSSA was supposed to catch these things, especially a strong copyleft license like AGPL. It makes me nervous about what else it might be missing.
I'm still learning the ropes of compliance tooling, so maybe I'm configuring something wrong? Any tips would be really appreciated.
Yeah, that's surprising. I'd expect AGPL to be a big red flag for any scanner. Maybe check if you have any custom ignore rules set by accident? We had something similar where a .fossa.yml file was overriding the default scan.
Also, have you tried running it with the debug flag? Sometimes the raw output shows why it skipped something. Could be a version mismatch or the license file in the dependency isn't named something standard.