Running dpndncY without internet access (air-gapped)

dpndncY can scan with no internet connection. Vulnerability data then comes from an offline advisory database: a single file you build on a machine that does have internet access, carry across, and import. It contains:

Matching runs locally with the same version rules as each package manager. In our tests against the OSV API, local matching gave identical answers on 501 of 501 package/version checks across npm, PyPI, Maven, Go, NuGet, RubyGems, Packagist, crates.io, Debian and Alpine.

#1. Turn on air-gapped mode

In .env (or --set config.airgapped=true with Helm):

DPNDNCY_AIRGAPPED=true

This stops every call to OSV, GitHub, NVD, CISA, FIRST and the license server. Until a database is imported, scans say that no package could be checked. They do not silently report zero vulnerabilities.

#2. Build the database (on a machine with internet)

Use any machine with Node.js 20+ and a copy of dpndncY:

node scripts/advisory-db.js build

This downloads about 370 MB and takes about five minutes. It writes two files:

dpndncy-advisories-2026-10-12.db          (~450 MB)
dpndncy-advisories-2026-10-12.db.sha256

The default covers npm, PyPI, Maven, Go, NuGet, RubyGems, Packagist, crates.io, Pub, Hex, SwiftURL, CRAN, Debian and Alpine. To choose ecosystems, for example to add Ubuntu (about 750 MB more):

node scripts/advisory-db.js build --ecosystems npm,PyPI,Maven,Debian,Ubuntu

If your organisation mirrors these feeds internally, point the build at the mirror folder instead of the internet:

node scripts/advisory-db.js build --source-dir /mirror/osv

The folder can hold <Ecosystem>/all.zip (or <Ecosystem>.zip, or an <Ecosystem>/ folder of OSV .json files), plus known_exploited_vulnerabilities.json and epss_scores-*.csv.gz.

#3. Carry both files across

Copy both the .db and the .sha256 file through your approved transfer process. The import refuses a database whose checksum does not match, so a damaged or incomplete copy can't be used.

#4. Import

Pick whichever fits your installation.

Drop it in the inbox (works everywhere, including the Windows installer). Copy both files into the advisories/inbox folder inside dpndncY's data folder:

Create the inbox folder if it doesn't exist. Within about a minute the server checks the file and switches to it. A file that fails the check is renamed to .rejected, and the reason is written next to it in .error.txt.

Or use the command line (Docker, Helm, or source installs):

node scripts/advisory-db.js import dpndncy-advisories-2026-10-12.db

A running server switches to the new database within 30 seconds. You don't need to restart it.

#5. Check it

node scripts/advisory-db.js status

Or open System health in the web app. In air-gapped mode the OSV / GHSA advisories row shows the database's build date and size. It turns stale when the database is more than 14 days old.

#Keeping it current

New vulnerabilities are published every day. Repeat steps 2–4 regularly, weekly or more often. Each import replaces the previous database.

#What is different from online mode

• NVD-only CVEs. Online, dpndncY can also search NVD for CVEs that no OSV source covers. That search is not available offline. OSV already includes GitHub's advisories, the ecosystems' own databases and NVD-derived data for most packages.
• CVSS source. Online, an NVD score is preferred when an NVD API key is set. Offline, scores come from the advisory's own CVSS vector. Usually these are the same; occasionally NVD and GitHub rate a CVE differently.
• Transitive dependencies need a lockfile or a registry mirror. dpndncY resolves some dependency trees by asking the package registry (npm, PyPI, Maven Central). Offline, scan lockfiles (package-lock.json, poetry.lock, go.sum, a pip freeze output, mvn dependency:tree output), or point your build tools at an internal mirror. When something cannot be resolved, the scan says so in its warnings.
• License lookups. License data that normally comes from the registry is marked unknown unless it is in the project itself.

#Settings reference