Seal Apps

Sealed packages for your application's third-party open-source dependencies.

Seal Apps remediates vulnerabilities in your application's third-party open-source dependencies. The packages your code pulls in directly, and the packages those packages pull in transitively, are replaced with sealed versions of the same origin versions.

What it covers

Application-dependency ecosystems:

• JavaScript: npm, Yarn, pnpm

• Python: pip, Poetry

• Java: Maven, Gradle

• Go: Go modules

• PHP: Composer

• Ruby: Bundler

• .NET: NuGet

Seal Apps does not cover language runtimes themselves (the Node.js binary, the Python interpreter, the JVM, the .NET CLR). Those are handled by Seal OS when installed via OS package managers, or by Seal Base Images, Seal My Container, or Seal Vendor Apps when bundled in container images.

How it is delivered

Seal Apps uses build-time dependency sealing. It supports several deployment methods:

• The Seal CLI in your CI/CD pipeline (recommended). The CLI ensures that sealed versions are used in place of vulnerable origin versions; your build proceeds as before, and the artifact you ship incorporates the sealed dependencies.

• The Seal Artifact Server as a configured remote (or as an additional remote) in your package manager.

• Manual download of sealed versions directly from the Repository page.

Related

• Choosing your deployment method: day-1 setup options for Seal Apps.

• Working with Seal Apps: the day-to-day workflow.