17.5
GitHub CodeQL is a language and toolchain for analyzing code as data.
Free planWebExtensionLinux
Alternatives to Renovate
27.4
Endor Labs is an application security platform for code, dependencies, secrets, container images, and AI coding agents.
Free planWebAPIExtension
37.3
Snyk Open Source is a software composition analysis tool for finding and addressing security vulnerabilities and license issues in open source dependencies.
Free planWebAPILinux
- 4
ActiveState Platform
ActiveState Platform hosts custom runtimes assembled from source.
Free planWebAPILinuxmacOS7.2Free plan - 5
Socket
Socket is a developer-first security platform for finding and blocking vulnerable or malicious software dependencies.
Free planWebAPIExtensionLinux7.2From $25 a month - 6
Mend SCA
Mend SCA helps development, security, and legal teams identify, prioritize, and remediate security and license risks in open source components.
WebAPILinuxmacOS7.0From $250 a year - 7
DepsHub
DepsHub automates dependency updates, license checks, and vulnerability scanning for software projects.
Free planWebLinuxmacOSWindows6.9From $19 a month - 8
Depfu
Depfu helps keep software dependencies current by sending update pull requests to GitHub and GitLab repositories.
Free planWebSelf-hosted6.6From $29 a month - 9
Kusari
Kusari is a software supply chain security platform that builds an updated knowledge graph of components across repositories, images, and pipelines.
Free planWebAPI6.6From $50 a month - 10
FOSSA
FOSSA scans software to identify dependencies, vulnerabilities, and license issues across the development lifecycle.
Free planWebAPILinuxSelf-hosted6.4Free plan - 11
Updatecli
Updatecli automates file updates through YAML manifests.
Free planLinuxmacOSSelf-hostedWindows6.4Free plan - 12
Marshal
Marshal scans Maven and Gradle dependencies for behavioral signs associated with supply-chain attacks and can block risky updates at pull-request time.
Free planSelf-hosted6.3Free plan - 13
6.3From €20 a month - 14
FossID Workbench
FossID Workbench is a software composition analysis tool for identifying and governing third-party components, licenses, and vulnerabilities in codebases.
WebAPILinuxSelf-hosted6.2 - 15
JFrog Xray
JFrog Xray is a paid software composition analysis tool for finding, prioritizing, and remediating vulnerabilities and license compliance issues in…
WebAPISelf-hosted6.2From $950 a month - 16
OSS Review Toolkit
OSS Review Toolkit (ORT) is a free, open-source toolkit for managing software dependencies and automating FOSS policy checks.
Free planLinuxmacOSSelf-hostedWindows6.2Free plan - 17
OWASP Dependency-Track
OWASP Dependency-Track is a free, open-source platform for inventorying software components from SBOMs, identifying vulnerabilities, and enforcing supply-chain policies.
Free planWebAPISelf-hosted6.2Free plan - 18
Black Duck SCA
Black Duck SCA helps teams manage security, quality, and license compliance risks in open-source and third-party code.
WebAPILinuxmacOS5.9 - 19
GitHub Secret Scanning
GitHub Secret Scanning detects exposed credentials so they can be addressed before they are exploited.
WebAPISelf-hosted5.9From $19 a month - 20
Lineaje Open Source Manager
Lineaje Open Source Manager gives organizations visibility into open-source components and ways to manage their associated risks.
WebAPI5.3 - 21
Veracode SCA
WebLinuxmacOSWindows5.2 - 22
Checkmarx SCA
Checkmarx SCA is a cloud-deployed, web-based module for open-source security, license compliance, and software bill of materials generation.
Web4.9 - 23
Revenera Code Insight
WebLinuxWindows4.9 - 244.8
- 254.8
- 264.7