A private registry and pull-through cache for the ecosystems your builds use
Dependably Packages runs inside your perimeter and stands between your builds and the public registries. It proxies and caches eleven package ecosystems and hosts your own packages on the same coordinates. It verifies checksums against the digest the upstream publishes, can verify publisher signatures, screens against OSV where OSV has a feed, and refuses a version under a fourteen-arm policy gate you configure per tenant. Every fetch, refusal, and token event lands in an audit log you can stream to a SIEM.
- npm JavaScript · npm · yarn · pnpm
- PyPI Python · pip · uv
- Maven Java · Maven · Gradle
- NuGet C# / .NET · dotnet
- Cargo Rust · cargo · crates.io
- Docker OCI · container images
- RPM Linux · dnf · yum
- Go Go modules · go get · mirror only
- Alpine apk Alpine · apk · mirror only
- Terraform Terraform · providers · mirror only
- Hex Elixir · Erlang · mix · rebar3
Every install passes policy, scan, and audit before it reaches your code.
A private mirror for your third-party packages.
Proxy your registries through a single endpoint inside your perimeter. Upstream fetches are checksum-verified against the digest the upstream publishes before they land in cache. Block by version, by licence or by OSV severity threshold, and on npm, PyPI, and NuGet by package pattern.
Daily OSV scans that catch advisories on cached versions.
Every uploaded or proxied version is rescanned against the OSV database every 24 hours. OSV has no feed for container images or Terraform providers, so those are not scanned. Matching versions can be set to block subsequent installs by manual override or OSV score threshold.
Audit with provenance.
Time-ordered, append-only log of pushes, downloads, policy decisions, and token lifecycle events. Read the full log as JSON, or forward every event to your SIEM: NDJSON over a webhook, CEF or RFC5424 over syslog.
From public registry to audited install.
Verified fetch
On a cache miss, Dependably Packages fetches from the upstream registry only for a name your token's capability permits, and on npm, PyPI, and NuGet only for a name your allow and block lists permit. It re-checks the upstream's declared digest against the bytes on disk, and a mismatch is audited and refused. Source pinning, which binds a name to the upstream that first served it, is available as an instance setting.
checksum verifyPolicy gate
The staged version is checked against your deprecation rules and publisher-provenance requirements before any catalogue row exists, so a version refused there is never adopted into the cache. The gate fails closed on an unsigned artefact when enforcement is on. Your licence policy refuses at download when it is set to block.
pattern matchOpen Source Vulnerabilities
The version is scanned against the OSV database and refused by your severity policy on the same pass. Results are persisted and re-checked daily, so new advisories surface on versions already cached.
scanAudit and traceability
Package activity is recorded with full audit context, including identity, timestamp, source, and requested artefacts. Logs are retained for investigation and can be read as JSON. Forward them to your SIEM as NDJSON over a webhook, or as CEF or RFC5424 over syslog.
observabilityRun it on your own hardware. Keep your registry inside your perimeter.
Dependably Packages ships as a single container image. No phone-home, no metered seats, no expiring licence.
- Air-gap friendly · no outbound network required after install
- Policy engine · block by version pin or OSV severity score, and by package pattern on npm, PyPI, and NuGet
- Single container, single binary, single SQLite database, with PostgreSQL when you need HA
- SAML SSO · or local users on day one
- English and French UI
Hosted by us, as the alternative to self-hosting.
Same engine, same policies, same audit stream, on a paid plan we operate for you. Get in touch to talk about a hosted deployment.
- Managed upgrades and patching
- Hosted in AWS Canadian regions by default
- A Data Processing Addendum on any paid plan
Questions
Is Dependably Packages open source, and what does the hosted version add?
The Community Edition is Apache-2.0 and self-hosted. The container image, the policy engine and the audit log are all in that release. Dependably Cloud runs the same engine on a paid plan we operate for you, hosted in AWS, with managed upgrades.
Which package ecosystems does Dependably Packages proxy, and which can I publish to?
It proxies and caches npm, PyPI, Maven, NuGet, Cargo, Docker, RPM, and Hex, plus Go, Alpine apk and Terraform as mirrors. You can publish your own packages to every one of those except Go, apk and Terraform, which are proxy-only.
What happens when a package fails a check?
The install is refused with an HTTP 403, and the refusal lands in the audit log with the rule that fired. On npm, PyPI, NuGet and RPM the response also carries a header naming the reason. A version can fail on a vulnerability an OSV scan finds, a licence outside your allow list, a listing on the CISA Known Exploited Vulnerabilities Catalog, a release younger than your configured minimum age, or an install script your policy doesn't permit. A download whose bytes don't match the digest the upstream publishes is refused with a 502 and audited.
Does Dependably Packages work air-gapped, without internet access?
Yes. It keeps serving normally, with no outbound network required after install. What you lose is the ability to pull anything new from an upstream registry and any rescan that depends on a live OSV feed; everything already cached and already scanned is unaffected.
How do I point npm, pip, Maven or NuGet at it?
Each client needs its registry URL changed to your Dependably Packages instance, and a token for authentication: an .npmrc registry line, a pip index-url, a Maven settings.xml mirror, or a NuGet package source. The exact steps for each ecosystem are in the documentation.
Where does Dependably Packages run, and what does it need?
It runs as a single container image: one binary and a SQLite database, and the packages themselves go to local disk. Nothing else is required to start it self-hosted.
Can Dependably Packages replace another self-hosted registry my team already runs?
It can, if your ecosystems are among the eleven it proxies and caches. It hosts your own packages on the same coordinates and adds checksum verification against the upstream's own digest, policy gates on licence and vulnerability severity, and an audit log of every fetch and policy decision, all from one container image.
Does Dependably Packages include a NuGet symbol server?
Yes. It serves symbols for the NuGet packages it hosts, so debugging into one doesn't need a separate symbol server running alongside it.