diff --git a/.github/.fossa.yml b/.github/.fossa.yml
new file mode 100644
index 00000000000..d639b393e98
--- /dev/null
+++ b/.github/.fossa.yml
@@ -0,0 +1,15 @@
+version: 3
+
+# https://github.com/fossas/fossa-cli/blob/master/docs/references/files/fossa-yml.md
+
+project:
+  id: github.com/gnolang/gno
+  name: gno
+
+targets:
+  only:
+    - type: gomod
+
+paths:
+  exclude:
+    - ./misc/
diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml
new file mode 100644
index 00000000000..3036720f6eb
--- /dev/null
+++ b/.github/workflows/fossa.yml
@@ -0,0 +1,50 @@
+name: Dependency License Scanning
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - ".github/.fossa.yml"
+      - ".github/workflows/fossa.yml"
+  schedule:
+    - cron: '0 0 * * 6' # At 00:00 on saturdays
+
+permissions:
+  contents: read
+
+jobs:
+  fossa:
+    name: Fossa
+    runs-on: ubuntu-latest
+    if: github.repository == 'gnolang/gno'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          # we don't know what commit the last tag was it's safer to get entire repo so previousStableVersion resolves
+          fetch-depth: 0
+
+      - name: Move .fossa.yml to root dir
+        run: mv .github/.fossa.yml .
+
+      - name: Cache Coursier cache
+        uses: coursier/cache-action@v6.4.0
+
+      - name: Set up JDK 17
+        uses: coursier/setup-action@v1.3.0
+        with:
+          jvm: temurin:1.17
+
+      - name: Set up fossa CLI
+        run: "curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install-latest.sh | bash"
+
+      - name: FOSSA analyze
+        run: fossa analyze
+        env:
+          FOSSA_API_KEY: "${{secrets.FOSSA_API_KEY}}"
+
+      - name: FOSSA test
+        run: fossa test
+        env:
+          FOSSA_API_KEY: "${{secrets.FOSSA_API_KEY}}"
+
diff --git a/.github/workflows/gnoland.yml b/.github/workflows/gnoland.yml
index 9fdfa3011cc..e2b099c2b92 100644
--- a/.github/workflows/gnoland.yml
+++ b/.github/workflows/gnoland.yml
@@ -74,13 +74,25 @@ jobs:
           export GOPATH=$HOME/go
           export GOTEST_FLAGS="-v -p 1 -timeout=30m -coverprofile=coverage.out -covermode=atomic"
           make ${{ matrix.args }}
-      - if: ${{ runner.os == 'Linux' && matrix.goversion == '1.21.x' }}
+      - uses: actions/upload-artifact@v3
+        if: ${{ runner.os == 'Linux' && matrix.goversion == '1.21.x' }}
+        with:
+          name: ${{runner.os}}-coverage-gnoland-${{ matrix.args}}-${{matrix.goversion}}
+          path: ./gno.land/coverage.out
+
+  upload-coverage:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download all previous coverage artifacts
+        uses: actions/download-artifact@v3
+        with:
+          path: ${{ runner.temp }}/coverage
+      - name: Upload combined coverage to Codecov
         uses: codecov/codecov-action@v3
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          name: gno.land
-          flags: gno.land-${{matrix.args}}
-          files: ./gno.land/coverage.out
+          directory: ${{ runner.temp }}/coverage
+          token: ${{ secrets.CODECOV_TOKEN }} 
           fail_ci_if_error: ${{ github.repository == 'gnolang/gno' }}
 
   docker-integration:
diff --git a/.github/workflows/gnovm.yml b/.github/workflows/gnovm.yml
index 034aa109767..71b03b5ca05 100644
--- a/.github/workflows/gnovm.yml
+++ b/.github/workflows/gnovm.yml
@@ -78,12 +78,24 @@ jobs:
           export GOPATH=$HOME/go
           export GOTEST_FLAGS="-v -p 1 -timeout=30m -coverprofile=coverage.out -covermode=atomic"
           make ${{ matrix.args }}
-      - if: ${{ runner.os == 'Linux' && matrix.goversion == '1.21.x' }}
+      - uses: actions/upload-artifact@v3
+        if: ${{ runner.os == 'Linux' && matrix.goversion == '1.21.x' }}
+        with:
+          name: ${{runner.os}}-coverage-gnovm-${{ matrix.args}}-${{matrix.goversion}}
+          path: ./gnovm/coverage.out
+
+  upload-coverage:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download all previous coverage artifacts
+        uses: actions/download-artifact@v3
+        with:
+          path: ${{ runner.temp }}/coverage
+      - name: Upload combined coverage to Codecov
         uses: codecov/codecov-action@v3
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          name: gnovm
-          verbose: true
-          flags: gnovm-${{matrix.args}}
-          files: ./gnovm/coverage.out
+          directory: ${{ runner.temp }}/coverage
+          token: ${{ secrets.CODECOV_TOKEN }} 
           fail_ci_if_error: ${{ github.repository == 'gnolang/gno' }}
+
diff --git a/.github/workflows/tm2.yml b/.github/workflows/tm2.yml
index fc744ccc2ef..7b78ccb1e0f 100644
--- a/.github/workflows/tm2.yml
+++ b/.github/workflows/tm2.yml
@@ -68,12 +68,24 @@ jobs:
           export GOTEST_FLAGS="-v -p 1 -timeout=30m -coverprofile=coverage.out -covermode=atomic"
           make ${{ matrix.args }}
           touch coverage.out
-      - if: ${{ runner.os == 'Linux' && matrix.goversion == '1.21.x' }}
+      - uses: actions/upload-artifact@v3
+        if: ${{ runner.os == 'Linux' && matrix.goversion == '1.21.x' }}
+        with:
+          name: ${{runner.os}}-coverage-tm2-${{ matrix.args}}-${{matrix.goversion}}
+          path: ./tm2/coverage.out
+
+  upload-coverage:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download all previous coverage artifacts
+        uses: actions/download-artifact@v3
+        with:
+          path: ${{ runner.temp }}/coverage
+      - name: Upload combined coverage to Codecov
         uses: codecov/codecov-action@v3
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          name: tm2
-          verbose: true
-          flags: tm2-${{matrix.args}}
-          files: ./tm2/coverage.out
+          directory: ${{ runner.temp }}/coverage
+          token: ${{ secrets.CODECOV_TOKEN }} 
           fail_ci_if_error: ${{ github.repository == 'gnolang/gno' }}
+
diff --git a/go.mod b/go.mod
index d7544ddcdf5..06329b2f02d 100644
--- a/go.mod
+++ b/go.mod
@@ -27,7 +27,7 @@ require (
 	github.com/peterbourgon/ff/v3 v3.4.0
 	github.com/pmezard/go-difflib v1.0.0
 	github.com/rogpeppe/go-internal v1.11.0
-	github.com/rs/cors v1.10.0
+	github.com/rs/cors v1.10.1
 	github.com/stretchr/testify v1.8.4
 	github.com/tecbot/gorocksdb v0.0.0-20191217155057-f0fad39f321c
 	go.etcd.io/bbolt v1.3.7
diff --git a/go.sum b/go.sum
index b038376393c..77c72cfab69 100644
--- a/go.sum
+++ b/go.sum
@@ -150,8 +150,8 @@ github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
 github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
-github.com/rs/cors v1.10.0 h1:62NOS1h+r8p1mW6FM0FSB0exioXLhd/sh15KpjWBZ+8=
-github.com/rs/cors v1.10.0/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
+github.com/rs/cors v1.10.1 h1:L0uuZVXIKlI1SShY2nhFfo44TYvDPQ1w4oFkUJNfhyo=
+github.com/rs/cors v1.10.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spaolacci/murmur3 v1.1.0 h1:7c1g84S4BPRrfL5Xrdp6fOJ206sU9y293DDHaoy0bLI=