# From lockfile to Cyber Resilience Act evidence pack

> Paste a lockfile or SBOM and get every component checked against the OSV vulnerability database, the smallest fixed version per flaw, licence risk, and a mapping to CRA Annex I and Article 14.

Who it is for: CTOs, engineering leads and compliance owners at software and connected-device makers selling into the EU, who must show their dependency tree is under control before the Cyber Resilience Act applies in full on 11 December 2027.

## What you get

- **Every flaw once**: One finding per distinct flaw with CVE and GHSA aliases merged, a CVSS v3 score computed from the published vector, and the smallest fixed version above yours or no fix published.
- **VEX-style triage**: Affected, or proposed not affected for dev-only packages, which you confirm.
- **Licence risk**: Licences from your file or the npm and PyPI registries, classified for copyleft or restricted terms. Ambiguous or missing ones are flagged unresolved, never guessed.
- **Remediation plan and CRA mapping**: Fix now, schedule, no fix or licence review, and each CRA requirement marked evidence provided, action needed or not assessed.

## How it works

1. Choose `audit_inventory` and paste your file into `content`, with its `filename`.
2. Optionally name the `product` and set `include_dev`.
3. Run it in Apify Console, through the API or from your AI assistant. Use `cra_requirements` to read the requirements themselves.

## Use cases

- Preparing evidence for a CRA conformity assessment.
- A vulnerability and licence review before a release or a due diligence.
- Prioritising which dependencies to upgrade first.

## Pricing

- CRA evidence pack for one lockfile or SBOM: $1.76
- Component assessed (first 1,000): $0.006
- Component assessed (1,001 to 2,000): $0.003

You pay per event listed above; there is no monthly fee.

## Limits

- Process duties such as disclosure policy, update distribution and Article 14 reporting cannot be shown by an inventory and are marked not assessed.
- Exploitation status is not checked. Not legal advice.
- Up to 2,000 unique components; yarn berry, Pipfile.lock and XML SBOMs are refused for free.

## Questions

### Which files does it read?

package-lock.json, yarn.lock, pnpm-lock.yaml, uv.lock, poetry.lock, pinned requirements.txt, and CycloneDX or SPDX JSON SBOMs.

### What does an audit cost?

$1.76 per audit plus $0.006 per component assessed, or $0.003 per component in bulk.

### Is this a CRA certificate?

No. It is an evidence pack: what your inventory shows, what needs action and what an inventory cannot show.

Audit your dependencies: https://apify.com/eloquent_mountain/cra-sbom-audit?utm_source=actors.taskmastergpt.nl&utm_medium=llms&utm_campaign=cra-sbom-audit