Trust · Veritome

Software bill of materials

Working toward the Cyber Resilience Act (EU) 2024/2847, Veritome tracks every npm package the platform uses in its dependency manifest and lockfile. The summary below is counted from that manifest at each deployment, the full software bill of materials is produced from the lockfile when it is requested, and Dependabot proposes dependency updates every week.

Runtime dependencies

Build dependencies

Total direct packages

Licence types

Licence distribution

Other51 packages

MIT10 packages

Apache-2.05 packages

Requesting the full SBOM

Customers, prospective customers under NDA and market surveillance authorities can request the full SBOM, with every runtime npm package and its version, in SPDX or CycloneDX format from security@veritome.eu. We do not publish component versions openly, because a public list of exact versions is a ready-made checklist for anyone looking for an unpatched component.

Counts cover direct dependencies, not the full transitive tree, and are updated with each deployment. Licence labels are indicative and classified best-effort; the full SBOM carries each package's authoritative licence.