Dependabot

Renovate

renovatebot/renovate

Popular

Highly configurable dependency update bot for 90+ package managers on any Git platform, with grouping and automerge.

Knip

webpro-nl/knip

Trending (detected automatically)Rising

Finds unused files, exports and dependencies in JS/TS projects and monorepos.

npm-check-updates

raineorshine/npm-check-updates

Upgrades package.json dependencies to the latest versions, ignoring specified ranges.

Snyk

snyk/cli

Popular

Developer security platform for dependency, code, container and IaC scanning with automated fix PRs.

Socket

socket.dev

Trending

Detects malicious and risky open-source packages (typosquats, install scripts) before they reach your app.

OSV-Scanner

google/osv-scanner

Rising

Google's free scanner that checks lockfiles, SBOMs and containers against the OSV vulnerability database.

Syft

anchore/syft

Generates SBOMs in SPDX and CycloneDX formats from container images and filesystems.

Grype

anchore/grype

Vulnerability scanner for container images, filesystems and SBOMs; pairs with Syft.

Cosign

sigstore/cosign

Popular

Sigstore tool that signs and verifies container images and artifacts with keyless OIDC signing.