Critical Severity
Published: Nov 12, 2026
Open-source, self-hosted continuous vulnerability and end-of-life management: a live inventory of every piece of software you run, re-checked every hour, so you fix what matters first.
# Stackurity
Open-source, self-hosted software inventory and upgrade intelligence. Stackurity discovers software across hosts, repositories, containers and SBOMs, keeps one inventory with evidence for every component, and shows clearly what was **not** checked.
> **Status:** an early release under active development; see the [latest release](https://github.com/stackurity/stackurity/releases/latest) and the [changelog](CHANGELOG.md). Inventory, intelligence, alerts and team workflow, stack packs, Kubernetes, Jira and workspaces are in Community; see the [known limitations](#known-limitations) below and [editions](#editions) for what Pro and Enterprise add.
## What it does today
- **Hosts:** a read-only, unprivileged agent for Linux (dpkg, rpm and apk) and Windows (registry). On Linux it also finds runtimes and servers installed outside the package manager (Node.js from nvm, downloaded database binaries) and flags hosts that need a reboot to run patched code. It can also read the libraries deployed applications actually have installed (node_modules, Python virtualenvs, Composer vendor, and front-end libraries loaded from a CDN or copied into a site), so each application appears with its host, web server, runtime and repository in one stack view. With `--docker` (opt-in) it also reads the images of the host's running Docker containers, locally built ones included, without running anything in them ([details](docs/install.md#docker-containers)).
- **Repositories:** npm, yarn, pnpm, Composer, Poetry, Pipenv, pip (pinned), Go modules, Bundler, NuGet and Dart/Flutter pub, including direct and transitive dependencies. More technologies come as [stack packs](docs/packs.md): signed, sandboxed WebAssembly readers an administrator installs when their estate needs them, such as Java (Maven and Gradle) and Rust (Cargo). Scans run server-side from Git or in CI, where they can fail the pipeline on a severity, priority or known exploitation threshold. Lockfiles are parsed as data