Alternatives to Dependency-Track
Track component risk using software bills of materials. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Dependency-Track
Track component risk using software bills of materials.
Replacements
Listings that take over the same core job as Dependency-Track.
DefectDojo
An open source, self-hosted vulnerability management platform that collects and tracks findings from security scanners.
DefectDojo is a self-hosted vulnerability management platform that imports findings from many scanners, with some features reserved for a paid Pro edition.
Also worth comparing
These listings name Dependency-Track as their own alternative, so the relationship runs both ways.
Dependency-Check
OWASP scanner that finds known vulnerabilities in a project's dependencies.
Dependency-Track is a self-hosted web platform that tracks component risk centrally from software bills of materials rather than a scanner run inside each build.
OSV-Scanner
Check project dependencies against the OSV vulnerability database.
Dependency-Track is a self-hosted web platform tracking component risk from SBOMs over time, rather than a one-off command-line check.
Similar software
Related functionality, not a direct replacement.
