v3.20.2

• Bun: when bun.lock installs a package at more than one version, the extra versions (stored under nested keys like "express/path-to-regexp") are now reported, and their parents link to the correct version instead of the top-level one. (#1802)
• Pnpm: preserve distinct peer-resolution snapshots during graph construction so all resolved peer versions and their dependency edges are retained, without mixing production and development environments between resolutions. (#1776)
• Pnpm: optionalDependencies are now read from the lockfile. A project's own optional dependencies are reported as direct dependencies instead of transitive ones, and a package's optional dependencies are connected to it in the graph instead of appearing as unrelated transitive dependencies. Platform packages such as fsevents, sharp's @img/* libraries, and the @esbuild/* binaries are the usual cases. (#1766)
• Pnpm: workspace members are now individual build targets, so a single member can be analyzed on its own with --only-target 'pnpm@./:my-package' or a target: entry in .fossa.yml. Previously every member's dependencies were merged into one result with no way to scope them. Dependencies a selected member reaches through the workspace protocol (link: in the lockfile) are included. Scoped analysis preserves development-only workspace links and each member's resolved peer versions. Unfiltered analysis retains the whole workspace. (#1763)
• Node: when a yarn, npm, or pnpm workspace root or member has no name in its package.json, discovery now warns that no build targets can be offered for the workspace and that adding a name enables them. This also preserves unnamed members' dependencies during unfiltered analysis. (#1763)
• Node: package.json-only analysis now resolves pnpm catalog: references from the nearest pnpm-workspace.yaml, including scans started inside a workspace member. Catalog dependencies are reported with their declared versions or ranges. References that remain unresolved, and local workspace: or link: references, are skipped with a warning rather than reported at literal protocol strings as versions. (#1765)