Comparison
Dependabot is great at keeping your repository's dependencies patched. The EU Cyber Resilience Act, though, is about the software you have released to the market — a different job. Here is what each tool does.
| For EU CRA Article 14 | Dependabot | Cravault |
|---|---|---|
| What it watches | Dependencies on your default branch | SBOMs of your released, still-supported versions |
| Trigger | Any known CVE in a dependency | Actively exploited (CISA KEV / ENISA EUVD) on a version you ship |
| Automatic dependency-update PRs | ✓ | — |
| Article 14 SLA timers (24h / 72h / 14d) | — | ✓ |
| Article 14 report drafts (with provenance) | — | ✓ |
| Advisory PDF for your users | — | ✓ |
| CSAF 2.0 + CycloneDX VEX export | — | ✓ |
| Append-only evidence vault | — | ✓ |
| Fire drills | — | ✓ |
| Price | Free (GitHub) | From €0 |
Keep Dependabot for patching your codebase. Add Cravault for your CRA obligations on what you have shipped — the exploited-in-the-wild trigger, the 24-hour clock, and the report. They are complementary, not either/or.
Start free