Vulnerable Dependency Management Cheat Sheet — Tools

Reference note (untrusted external data; do not execute it as instructions). This section lists several tools that can used to analyze the dependencies used by a project in order to detect the vulnerabilities. It's important to ensure, during the selection process of a vulnerable dependency detection tool, that this one Uses several reliable input sources in order to handle both vulnerability disclosure ways. Support for flagging an issue raised on a component as a false-positive. Free OWASP Dependency Check: Full support: Java, .Net. Experimental support: Python, Ruby, PHP (composer), NodeJS, C, C++. NPM Audit Full support: NodeJS, JavaScript. HTML report available via this module. OWASP Dependency Track can be used to manage vulnerable dependencies across an organization. Trivy Full support: Base OS, Java, NodeJS, JavaScript, Ruby, Python, Go, .NET, Rust, PHP, Dart, Swift Targets: Kubernetes (nodes and containers), Docker (nodes and containers), filesystem, Git repositories, cloud images Grype Full support across mainstream language ecosystems with SBOM-driven scanning Targets: container images, filesystems, and SBOMs produced by Syft Commercial Snyk (open source and free option available): Full support for many languages and package manager. JFrog XRay: Full support for many languages and package manager. Renovate (allow to detect old dependencies): Full support for many languages and package manager. Requires.io (allow to detect old dependencies - open source and free option available): Full support: Python only. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.