Free browser tool checks EU CRA Article 14 compliance via dependency lockfiles

·15 views

A developer has released a free, browser-based tool at cra.toledotechnologies.com/check that lets users check software dependencies for EU Cyber Resilience Act Article 14 obligations by pasting common lockfiles or SBOMs. Under Article 14, enforceable from 11 September 2026, companies must notify their national CSIRT and ENISA within 24 hours if a vulnerability in their EU-market product is being actively exploited. The tool cross-references declared dependencies against the OSV.dev advisory database and CISA's Known Exploited Vulnerabilities catalogue, with all processing done locally in the browser and no file contents sent to the developer's servers. A companion GitHub Action, cra-watch, is also available for automated CI pipeline checks across twelve lockfile formats. The developer cautions that a KEV match does not automatically trigger a reporting obligation, and that reachability of the vulnerable code path remains a key factor under the European Commission's July 2026 guidance.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

GitHub's new star history endpoint powers a README star chart generator

GitHub restricted its stargazers listing to repo admins and collaborators this year, which broke existing star history tools. In September it added a star history endpoint that returns stars grouped by calendar week for any public repo without authentication. The author built a README chart generator on it, fetching pages in parallel and summing weekly totals, which matched live star counts on seven tested repos. Because README images cannot run scripts, the chart is a server-rendered Svelte component producing an animated SVG, while a separate plain SVG converted to PNG handles social previews.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Word Counting Is Harder Than a Simple Space Split Suggests

A common naive word counter splits text on whitespace, which breaks on contractions, hyphens, em dashes, decimals, and emoji. The article argues this is a text segmentation problem rather than a rounding issue. It recommends the browser's Intl.Segmenter API, using word granularity and filtering by isWordLike to exclude emoji from word counts. It also notes that text.length counts UTF-16 code units rather than visible characters, so grapheme granularity is better for character counts. The author discloses that they built a browser-based word counter that processes text locally without uploading it.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Shell Redirection and Pipes Work: >, >>, 2> and |

The article explains that every command has three text channels: stdin for input, stdout for normal results, and stderr for error messages. The > operator sends stdout to a file and overwrites it, while >> appends to the end of an existing file. Because stderr is stream 2, the 2> operator captures error messages separately, and 2>&1 merges errors into the same destination as normal output, with the order of redirections mattering. A pipe (|) passes one command's stdout directly into the next command's stdin, allowing small tools to be chained together. The piece notes that pipes carry only stdout, so errors from the left-hand command bypass the pipe.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer details AI-assisted plan for an SMS suite in the CabloyJS framework

A developer building an SMS suite for the CabloyJS fullstack framework shared the prompt they wrote and the development plan Claude Code produced in response. The suite is split into four modules: shared SMS infrastructure, SMS verification codes, phone-based registration and login, and a mock provider for development. The plan stresses that infrastructure, verification, and authentication should stay decoupled, and that the mock provider should not alter the real business flow. It proposes reusing the existing captcha and authentication systems, with backward-compatible extensions for phone binding and atomic code consumption. The developer presents the exchange as a representative example of a practical AI coding workflow.

0 comments Read more at DEV Community