Breaking change: Node 24 runtime

This action now runs on the Node 24 GitHub Actions runtime (previously Node 20), via #277.

• GitHub-hosted runners: no action needed.
• Self-hosted runners: you must be on a runner version that bundles the Node 24 runtime. Update your runner if you pin fossas/fossa-action@v2.

The @v1 line is unchanged and stays on Node 20, so existing @v1 users are not affected until they opt into @v2. #277 is the only change that touches the action's runtime code (dist/) — everything else below is CI or dev-tooling only.

Everything in v1.9.0 → v2.0.0

Action runtime

• Upgrade to Node.js 24 and Yarn 4 (Corepack, packageManager: [email protected], engines.node >= 24.0.0) — #277

CI / repo tooling (no effect on consumers)

• Fix the repo's fossa test --diff CI step to work with push events (first push to a new branch falls back to diffing the default branch) — #278
• Make dependabot ignore major-version bumps of @types/node — #291

Dev-dependency bumps (no effect on consumers)

• eslint 9.39.4 → 10.2.0 → 10.2.1 — #288, #297
• @typescript-eslint/eslint-plugin 8.58.0 → 8.58.2 — #290, #295
• @types/node 24.12.0 → 24.12.2 — #293
• globals 17.4.0 → 17.5.0 — #294
• @eslint/compat 2.0.3 → 2.0.4 — #287

Full changelog: v1.9.0...v2.0.0

What's Changed

• Bump actions/checkout from 5 to 6 by @dependabot[bot] in #245
• Bump @actions/tool-cache from 3.0.1 to 4.0.0 by @dependabot[bot] in #267
• Bump undici from 6.23.0 to 6.24.1 by @spatten in #275
• Add CI workflow to auto-rebuild dist by @spatten in #276
• Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #272
• Add CodeRabbit configuration by @chad-fossa in #271
• Bump @types/node from 25.2.0 to 25.2.1 by @dependabot[bot] in #269

New Contributors

• @chad-fossa made their first contribution in #271

Full Changelog: v1.8.0...v1.9.0

What's Changed

• Adds an optional working directory option to change where FOSSA analyzes.

What's Changed

• Upgrade node to v20 by @jssblck in #60
• Update dependencies, enable auto dependabot by @jssblck in #61

Full Changelog: v1.5.0...v1.6.0

What's Changed

• Adding team and policy by @saramaebee in #44
• Generate attribution report by @dylmye in #53, #57
• Add config option - Fixes #55 by @nficca in #59
• Screaming snake cases the examples in the readme by @pieterocp, @csasarak in #58
• Add a PR template. by @csasarak in #43
• Clarify action as a starting point by @jssblck in #51
• Dependabot configuration to update actions in workflow by @spatten in #47
• Bump actions/setup-node from 3 to 4 by @dependabot in #48
• Bump actions/upload-artifact from 3 to 4 by @dependabot in #49
• Bump actions/checkout from 3 to 4 by @dependabot in #50

New Contributors

• @saramaebee made their first contribution in #44
• @dependabot made their first contribution in #48
• @jssblck made their first contribution in #51
• @dylmye made their first contribution in #53
• @nficca made their first contribution in #59
• @pieterocp made their first contribution in #58

Full Changelog: v1.4.0...v1.5.0

What's Changed

• Support FOSSA CLI's --diff flag. by @csasarak in #41

Full Changelog: v1.3.3...v1.4.0

Add support for passing a --project argument to fossa.

• Switch action to use node20 before GH deprecates node16

Release v1.3.0 was cut on the same commit as v1.2.0. This release corrects that.