https://depproof.com/blog/ Measured writing on dependency governance, SBOMs, open-source license risk and supply-chain security. en Fri, 11 Sep 2026 12:00:00 GMT https://depproof.com/blog/nobody-left-to-fix-it/ https://depproof.com/blog/nobody-left-to-fix-it/ Fri, 11 Sep 2026 12:00:00 GMT We scanned 24 repositories in five ecosystems. About one component in seven shows nobody is maintaining it, at the same rate whether it ships or not. https://depproof.com/blog/findings-that-never-ship/ https://depproof.com/blog/findings-that-never-ship/ Thu, 10 Sep 2026 12:00:00 GMT We scanned 24 repositories in five ecosystems. Two in five findings sit on dependencies that never reach production, including 36% of criticals. https://depproof.com/blog/end-of-life-dependencies/ https://depproof.com/blog/end-of-life-dependencies/ Mon, 31 Aug 2026 12:00:00 GMT A finding asks whether a problem is known, not whether anyone will fix one. Why end-of-life is a second axis of risk, and the three places to check it. https://depproof.com/blog/keeping-up-with-sca/ https://depproof.com/blog/keeping-up-with-sca/ Wed, 26 Aug 2026 12:00:00 GMT SCA is not a one-off scan. What software composition analysis does, why your findings change while your code doesn’t, and the cadence that keeps up. https://depproof.com/blog/cvss-vs-epss-vs-kev/ https://depproof.com/blog/cvss-vs-epss-vs-kev/ Fri, 21 Aug 2026 12:00:00 GMT A severity threshold is both too wide and too narrow: 11% of CISA KEV entries are rated below high. How CVSS, EPSS and KEV differ — and how to gate CI. https://depproof.com/blog/osv-vs-cve-dependency-scanning/ https://depproof.com/blog/osv-vs-cve-dependency-scanning/ Fri, 14 Aug 2026 12:00:00 GMT CVE names a vulnerability; OSV describes which package versions it affects. Why that difference decides what your dependency scanner can find. https://depproof.com/blog/zero-findings-is-not-zero-risk/ https://depproof.com/blog/zero-findings-is-not-zero-risk/ Wed, 12 Aug 2026 12:00:00 GMT A clean dependency scan has two meanings that look identical: nothing is wrong, or nothing was read. Four signatures that tell them apart in five minutes. https://depproof.com/blog/depproof-hub-release/ https://depproof.com/blog/depproof-hub-release/ Wed, 29 Jul 2026 12:00:00 GMT The self-hosted depproof hub aggregates scans across every repo: blast-radius search, org-wide license posture, and waivers with an audit trail. https://depproof.com/blog/vulnerability-waivers-vex/ https://depproof.com/blog/vulnerability-waivers-vex/ Wed, 29 Jul 2026 12:00:00 GMT VEX (Vulnerability Exploitability eXchange) explained: what it is, the four status values, how it differs from an SBOM, and how waivers relate. https://depproof.com/blog/depproof-scanner-release/ https://depproof.com/blog/depproof-scanner-release/ Tue, 28 Jul 2026 12:00:00 GMT Self-hosted SCA for Java, JavaScript & Python — zero-config in GitHub Actions & GitLab CI: vulnerabilities, licenses, and a CycloneDX SBOM. https://depproof.com/blog/is-agpl-safe-for-commercial-saas/ https://depproof.com/blog/is-agpl-safe-for-commercial-saas/ Sun, 26 Jul 2026 12:00:00 GMT AGPL-3.0 is safe to use commercially — the risk is specific and avoidable. What Section 13’s network clause triggers, and when a SaaS product is affected. https://depproof.com/blog/why-npm-pnpm-audit-miss-vulnerabilities/ https://depproof.com/blog/why-npm-pnpm-audit-miss-vulnerabilities/ Sun, 26 Jul 2026 12:00:00 GMT A clean npm or pnpm audit is not proof your dependencies are safe. How audit really works, the four reasons it misses CVEs, and why the two disagree. https://depproof.com/blog/dependency-governance/ https://depproof.com/blog/dependency-governance/ Thu, 23 Jul 2026 12:00:00 GMT A regulated customer, SOC 2, or Cyber Resilience Act obligation turns per-repo scans into one org-wide answer — without a six-figure platform.