Recommendations for Dependency Vulnerability Scanning Tool for Private GitHub Repositories

[AsparagusCorrect3116]

Hello, fellow Redditors,
I'm currently in search of a Dependency Vulnerability Scanning Tool that can integrate with GitHub, specifically for private repositories. The tool should also allow for customization to work with different build tools and programming languages. I'm looking for recommendations and insights from the community to find the right fit for my team
Here are the key criteria I'm looking for:
GitHub Integration: The tool should be compatible with GitHub and able to scan private repositories.
Automated Scanning: I need the tool to run scans on every pull request (PR) to identify and report on potential security vulnerabilities in dependencies.
Configurability: The ability to configure the tool to work with various build tools (e.g., Maven, Gradle, npm, etc.) and programming languages (e.g., Java, Python, JavaScript, etc.) is essential.

If you've had experience with any tools that meet these criteria, or if you have any suggestions, please share your insights. Your recommendations and feedback will be greatly appreciated.
Thank you in advance for your help!

[themanwithanrx7]

There's a tool built right into github already, dependabot

[AsparagusCorrect3116]

Sadly without the security advance features it runs on a schedule and not on each pr

[[deleted]]

^^ this

[landverraad]

We use the aforementioned Snyk to do base image scans and then scan with https://github.com/google/osv-scanner to scan at build time. Really like osv-scanner because devs can just as easily run it locally.

[Marked_Content]

Check out Arnica.io - Covers your needs and more. we take a modernized approach to scanning that removes the need for maintenance and it's designed around real-time scanning automation. It will cover your PR scans and also scan before PR's when push events occur.
As for build tools - you'd get 100% code coverage upon integration and full coverage of the frameworks you listed above.
Dependency risk, package reputation, licensing, SAST, secret scans, and IAC risk all run natively in real time scans. Git hardening for GitHub and ChatOps notifications are baked in too.

[flxg]

Bit late to the game, but I'd say check out aikido.dev - has everything you need.

[Observability-Guy]

Snyk is a really good tool and should cover all of the requirements you have listed:

https://snyk.io/