17.8
Renovate finds outdated software packages and opens pull requests with updates, helping developers spend less time maintaining dependencies.
Free planOpen sourceWebAPISelf-hosted
Alternatives to Sonatype Guide
27.5
GitHub CodeQL is a language and toolchain for analyzing code as data.
Free planWebExtensionLinux
37.4
Endor Labs is an application security platform for code, dependencies, secrets, container images, and AI coding agents.
Free planWebAPIExtension
- 4
Snyk Open Source
Snyk Open Source is a software composition analysis tool for finding and addressing security vulnerabilities and license issues in open source dependencies.
Free planWebAPILinuxmacOS7.3From $25 a month - 5
ActiveState Platform
ActiveState Platform hosts custom runtimes assembled from source.
Free planWebAPILinuxmacOS7.2Free plan - 6
Socket
Socket is a developer-first security platform for finding and blocking vulnerable or malicious software dependencies.
Free planWebAPIExtensionLinux7.2From $25 a month - 7
Mend SCA
Mend SCA helps development, security, and legal teams identify, prioritize, and remediate security and license risks in open source components.
WebAPILinuxmacOS7.0From $250 a year - 8
DepsHub
DepsHub automates dependency updates, license checks, and vulnerability scanning for software projects.
Free planWebLinuxmacOSWindows6.9From $19 a month - 9
Depfu
Depfu helps keep software dependencies current by sending update pull requests to GitHub and GitLab repositories.
Free planWebSelf-hosted6.6From $29 a month - 10
Kusari
Kusari is a software supply chain security platform that builds an updated knowledge graph of components across repositories, images, and pipelines.
Free planWebAPI6.6From $50 a month - 11
FOSSA
FOSSA scans software to identify dependencies, vulnerabilities, and license issues across the development lifecycle.
Free planWebAPILinuxSelf-hosted6.4Free plan - 12
Updatecli
Updatecli automates file updates through YAML manifests.
Free planLinuxmacOSSelf-hostedWindows6.4Free plan - 13
Marshal
Marshal scans Maven and Gradle dependencies for behavioral signs associated with supply-chain attacks and can block risky updates at pull-request time.
Free planSelf-hosted6.3Free plan - 14
6.3From €20 a month - 15
FossID Workbench
FossID Workbench is a software composition analysis tool for identifying and governing third-party components, licenses, and vulnerabilities in codebases.
WebAPILinuxSelf-hosted6.2 - 16
JFrog Xray
JFrog Xray is a paid software composition analysis tool for finding, prioritizing, and remediating vulnerabilities and license compliance issues in…
WebAPISelf-hosted6.2From $950 a month - 17
OSS Review Toolkit
OSS Review Toolkit (ORT) is a free, open-source toolkit for managing software dependencies and automating FOSS policy checks.
Free planLinuxmacOSSelf-hostedWindows6.2Free plan - 18
OWASP Dependency-Track
OWASP Dependency-Track is a free, open-source platform for inventorying software components from SBOMs, identifying vulnerabilities, and enforcing supply-chain policies.
Free planWebAPISelf-hosted6.2Free plan - 19
Black Duck SCA
Black Duck SCA helps teams manage security, quality, and license compliance risks in open-source and third-party code.
WebAPILinuxmacOS5.9 - 20
GitHub Secret Scanning
GitHub Secret Scanning detects exposed credentials so they can be addressed before they are exploited.
WebAPISelf-hosted5.9From $19 a month - 21
Lineaje Open Source Manager
Lineaje Open Source Manager gives organizations visibility into open-source components and ways to manage their associated risks.
WebAPI5.3 - 22
Veracode SCA
WebLinuxmacOSWindows5.2 - 23
Checkmarx SCA
Checkmarx SCA is a cloud-deployed, web-based module for open-source security, license compliance, and software bill of materials generation.
Web4.9 - 24
Revenera Code Insight
WebLinuxWindows4.9 - 254.8
- 264.8