Software Composition Analysis Software: ranks 51–65
Page 2 of 2 of the full software composition analysis software ranking. Every tool here is researched from its official pricing and product pages. See our top picks →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Ranks 51–65 of 65 tools, best first
-
Best forGo teams needing reachability-focused vulnerability checks
Free Go vulnerability checks prioritize findings by whether vulnerable functions are called.
- Reachability analysis
- SBOM generation
5.3/10★★★☆☆Visit govulncheck -
Best forTeams scanning container images before deployment
A self-hosted scanner for image vulnerabilities, with continuous re-analysis as vulnerability data changes.
5.3/10★★★☆☆Visit Project Clair -
Best forOffline teams scanning common lockfile ecosystems
A focused offline SCA tool for lockfile scanning across nine dependency ecosystems.
- Reachability analysis
5.3/10★★★☆☆Visit Twira -
Best forFree JavaScript dependency vulnerability checks
A focused open-source scanner for npm, Yarn, and pnpm lockfiles.
5.3/10★★★☆☆Visit lockhawk -
Best forRust teams enforcing Cargo dependency policies
A Rust-focused policy checker for Cargo dependency graphs, with CI and pre-commit support.
- Pull request scanning
5.3/10★★★☆☆Visit cargo-deny -
Best forPython teams auditing dependencies for free
A focused, free SCA tool for auditing Python dependencies and generating SBOMs.
- SBOM generation
5.3/10★★★☆☆Visit pip-audit -
Best forJavaScript teams scanning web applications
A focused, free scanner for JavaScript and Node.js vulnerabilities, with CycloneDX SBOM output.
- SBOM generation
5.3/10★★★☆☆Visit Retire.js -
Best forSmall teams needing low-cost file-based scans
A low-cost option for file-based dependency vulnerability and license scans.
5.3/10★★★☆☆Visit VersionEye -
Best forJavaScript and Composer projects needing CI checks
A focused free CLI for vulnerability, license, and metadata checks in supported projects.
5.3/10★★★☆☆Visit Sandworm -
Best forSmall Ruby teams wanting automated dependency updates
A focused Ruby dependency updater for GitHub teams that want scheduled pull requests.
5.3/10★★★☆☆Visit deppbot -
Best forRuby teams auditing Bundler dependencies
A focused, open-source Gemfile.lock auditor for Ruby teams, with offline scans and JSON output.
5.3/10★★★☆☆Visit RubySec -
Best forSupply-chain risk and attestation workflows
A focused SCA tool for dependency reachability, SBOMs, attestation, and supply-chain risk.
- Reachability analysis
- SBOM generation
5.3/10★★★☆☆Visit Lineaje -
Best forGo teams needing simple dependency audits
A focused, free command-line scanner for Go modules, with flexible output and Sonatype integrations.
5.3/10★★★☆☆Visit Nancy -
Best forRust teams auditing Cargo dependencies
A focused open-source CLI for RustSec checks, reports, and dependency review.
5.3/10★★★☆☆Visit RustSec -
Best forDevelopers needing local speech enhancement
A local audio enhancement framework, not a software composition analysis tool.
0.5/10☆☆☆☆☆Visit DeepFilterNet
No tools match those filters.
Compare at a glance
| # | Tool | Free plan | Paid from | Supported ecosystems | SBOM generation | Score |
|---|---|---|---|---|---|---|
| 51 | govulncheck | Free | Go | Yes | 5.3 | |
| 52 | Clair | Yes | Free | 5.3 | ||
| 53 | Twira Dependency Vulnerabilities | Yes | $29.99/mo | npm, Cargo, PyPI, Go, Maven, RubyGems, Packagist, NuGet, Swift Package Manager | No | 5.3 |
| 54 | lockhawk | Yes | Free | npm, Yarn, pnpm | No | 5.3 |
| 55 | cargo-deny | Free | Rust; Cargo; crates.io; Git registries; Git repositories | 5.3 | ||
| 56 | pip-audit | Yes | Free | Python packages; pip; requirements files; pyproject.toml; pylock.*.toml | Yes | 5.3 |
| 57 | Retire.js | Yes | Free | JavaScript; Node.js modules; npm | Yes | 5.3 |
| 58 | VersionEye | No | €50/mo | Python, Ruby, Node.js, PHP; npm, Composer, Bundler, pip | No | 5.3 |
| 59 | Sandworm Audit | Yes | Free | npm, Yarn, pnpm, Composer | No | 5.3 |
| 60 | deppbot | Yes | RubyGems, Bundler, Gemfile, Gemfile.lock | 5.3 | ||
| 61 | bundler-audit | Free | Ruby gems and Bundler | 5.3 | ||
| 62 | Lineaje SCA360 | Major programming languages; Maven, Gradle, and npm build systems | Yes | 5.3 | ||
| 63 | Nancy | Yes | Free | Go (go.mod) | 5.3 | |
| 64 | cargo-audit | Free | Rust / Cargo | No | 5.3 | |
| 65 | DeepFilterNet | Yes | Free | 0.5 |
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Last updated · How we research and update