https://depproof.com/changelog/ Releases and feature updates for the depproof scanner, hub, and firewall. en https://depproof.com/changelog/#scanner-prioritisation-2026-08 https://depproof.com/changelog/#scanner-prioritisation-2026-08 Mon, 17 Aug 2026 12:00:00 GMT A severity threshold alone ships the vulnerability attackers are using: plenty of actively-exploited findings are rated only medium. The CI gate now takes exploitation evidence, CVSS score, and whether a fix exists — and a new fidelity rule fails the build when the dependency graph could not be fully resolved, the one case where a short findings list is the warning rather than the all-clear. https://depproof.com/changelog/#scanner-go-2026-07 https://depproof.com/changelog/#scanner-go-2026-07 Thu, 30 Jul 2026 12:00:00 GMT The scanner now audits Go projects alongside Java, JavaScript, and Python — the resolved module graph checked against OSV advisories for Go, licenses classified to SPDX, and Go components included in the CycloneDX SBOM and the CI gate. Same self-hosted container; your source never leaves your runner. https://depproof.com/blog/depproof-hub-release/ https://depproof.com/changelog/#hub-2026-07 Wed, 29 Jul 2026 12:00:00 GMT The self-hosted hub aggregates every repo’s scan reports into one cross-repo view — blast-radius search and org-wide license posture — and adds cybersec-owned waivers with an append-only audit trail (posture snapshots, expiry, OpenVEX/CSV export). A centrally-accepted finding stops failing every repo’s CI. Runs in your own network; reports never leave your infrastructure. https://depproof.com/blog/depproof-scanner-release/ https://depproof.com/changelog/#scanner-2026-07 Tue, 28 Jul 2026 12:00:00 GMT Audit your dependencies for known vulnerabilities and license risk across Java (Maven, Gradle), JavaScript/Node (npm, pnpm, yarn, bun), and Python (PyPI) — the full transitive tree, a CycloneDX SBOM, and a pass/fail CI gate. Runs self-hosted in GitHub Actions, GitLab CI, or any container; your source never leaves your runner.