Guides
depproof guides
Practical, honest walkthroughs for auditing dependency licenses, generating SBOMs, and answering compliance and procurement requests — scoped to what depproof actually does today, across Java, JavaScript, Python, and Go.
Maven license check without building your project
Audit every Maven dependency’s license — the full transitive tree — with no build and no lockfile, as a GitHub Action or a container.
Read the guide →How to respond when a customer requires an SBOM
A playbook for teams asked for a software bill of materials: what to clarify, how to generate a CycloneDX SBOM, and where to set honest scope.
Read the guide →Generate a CycloneDX SBOM for Maven — no build required
Produce a CycloneDX SBOM for a Java/Maven project — the full transitive tree — with no build and no lockfile, via a GitHub Action or a container.
Read the guide →Scan Maven & Gradle dependencies for vulnerabilities
Find known CVEs across your whole Java dependency tree — Maven with no build, Gradle after yours — and fail CI on a severity you set. Open advisory data (OSV), self-hosted.
Read the guide →npm license checker — audit every dependency’s license, no install
Check the license of every npm dependency, direct and transitive, straight from your lockfile — no npm install and nothing sent to a SaaS. A copy-paste GitHub Action and Docker recipe.
Read the guide →Scan npm dependencies for vulnerabilities — self-hosted
Find known CVEs across your whole npm tree from the lockfile and fail the build on a severity you set. Open advisory data (OSV), self-hosted, no npm install.
Read the guide →Scan Python dependencies for vulnerabilities — self-hosted
Find CVEs across your whole Python tree from poetry.lock, uv.lock, Pipfile.lock or requirements.txt — and why the file you scan decides what a clean result is worth.
Read the guide →pnpm audit not working? Causes, fixes & a self-hosted alternative
Why pnpm audit fails or returns nothing — a private registry with no audit endpoint, air-gapped CI, or a proxy — and how to scan pnpm-lock.yaml against OSV with no audit endpoint at all.
Read the guide →