17.8
Renovate finds outdated software packages and opens pull requests with updates, helping developers spend less time maintaining dependencies.
Free planOpen sourceWebAPISelf-hosted
Alternatives to Depfu
27.5
GitHub CodeQL is a language and toolchain for analyzing code as data.
Free planWebExtensionLinux
37.4
Endor Labs is an application security platform for code, dependencies, secrets, container images, and AI coding agents.
Free planWebAPIExtension
- 4
Snyk Open Source
Snyk Open Source is a software composition analysis tool for finding and addressing security vulnerabilities and license issues in open source dependencies.
Free planWebAPILinuxmacOS7.3From $25 a month - 5
ActiveState Platform
ActiveState Platform hosts custom runtimes assembled from source.
Free planWebAPILinuxmacOS7.2Free plan - 6
Socket
Socket is a developer-first security platform for finding and blocking vulnerable or malicious software dependencies.
Free planWebAPIExtensionLinux7.2From $25 a month - 7
Mend SCA
Mend SCA helps development, security, and legal teams identify, prioritize, and remediate security and license risks in open source components.
WebAPILinuxmacOS7.0From $250 a year - 8
DepsHub
DepsHub automates dependency updates, license checks, and vulnerability scanning for software projects.
Free planWebLinuxmacOSWindows6.9From $19 a month - 9
Kusari
Kusari is a software supply chain security platform that builds an updated knowledge graph of components across repositories, images, and pipelines.
Free planWebAPI6.6From $50 a month - 10
FOSSA
FOSSA scans software to identify dependencies, vulnerabilities, and license issues across the development lifecycle.
Free planWebAPILinuxSelf-hosted6.4Free plan - 11
Updatecli
Updatecli automates file updates through YAML manifests.
Free planLinuxmacOSSelf-hostedWindows6.4Free plan - 12
Marshal
Marshal scans Maven and Gradle dependencies for behavioral signs associated with supply-chain attacks and can block risky updates at pull-request time.
Free planSelf-hosted6.3Free plan - 13
6.3From €20 a month - 14
FossID Workbench
FossID Workbench is a software composition analysis tool for identifying and governing third-party components, licenses, and vulnerabilities in codebases.
WebAPILinuxSelf-hosted6.2 - 15
JFrog Xray
JFrog Xray is a paid software composition analysis tool for finding, prioritizing, and remediating vulnerabilities and license compliance issues in…
WebAPISelf-hosted6.2From $950 a month - 16
OSS Review Toolkit
OSS Review Toolkit (ORT) is a free, open-source toolkit for managing software dependencies and automating FOSS policy checks.
Free planLinuxmacOSSelf-hostedWindows6.2Free plan - 17
OWASP Dependency-Track
OWASP Dependency-Track is a free, open-source platform for inventorying software components from SBOMs, identifying vulnerabilities, and enforcing supply-chain policies.
Free planWebAPISelf-hosted6.2Free plan - 18
Black Duck SCA
Black Duck SCA helps teams manage security, quality, and license compliance risks in open-source and third-party code.
WebAPILinuxmacOS5.9 - 19
GitHub Secret Scanning
GitHub Secret Scanning detects exposed credentials so they can be addressed before they are exploited.
WebAPISelf-hosted5.9From $19 a month - 20
Lineaje Open Source Manager
Lineaje Open Source Manager gives organizations visibility into open-source components and ways to manage their associated risks.
WebAPI5.3 - 21
Veracode SCA
WebLinuxmacOSWindows5.2 - 22
Checkmarx SCA
Checkmarx SCA is a cloud-deployed, web-based module for open-source security, license compliance, and software bill of materials generation.
Web4.9 - 23
Revenera Code Insight
WebLinuxWindows4.9 - 244.8
- 254.8
- 264.7