Snyk

Dependabot

dependabot/dependabot-core

Popular

GitHub-native bot that opens PRs for dependency version and security updates across many ecosystems.

Renovate

renovatebot/renovate

Popular

Highly configurable dependency update bot for 90+ package managers on any Git platform, with grouping and automerge.

Socket

socket.dev

Trending

Detects malicious and risky open-source packages (typosquats, install scripts) before they reach your app.

OSV-Scanner

google/osv-scanner

Rising

Google's free scanner that checks lockfiles, SBOMs and containers against the OSV vulnerability database.

Syft

anchore/syft

Generates SBOMs in SPDX and CycloneDX formats from container images and filesystems.

Grype

anchore/grype

Vulnerability scanner for container images, filesystems and SBOMs; pairs with Syft.

Cosign

sigstore/cosign

Popular

Sigstore tool that signs and verifies container images and artifacts with keyless OIDC signing.

Dependency-Track

DependencyTrack/dependency-track

OWASP platform that continuously analyzes SBOMs across a portfolio for vulnerable and outdated components.

OpenSSF Scorecard

ossf/scorecard

Scores open-source projects on security practices like branch protection, pinned deps and signed releases.