Compared with the alternatives

Each of these does something this does not. That is not modesty — if one of them covers you, using it instead is the right answer and you will not have wasted an afternoon finding that out here.

A GitHub Dependabot alert

What it does better: Reads your lockfile and opens pull requests, which is more than this does.

Where this fits: It is per-repository and lives where the repository lives. If your manifests are not all on GitHub, or you want one weekly page across several services, that is the gap this fills. Dependabot is free and very good; if it covers your repositories, use it.

A commercial SCA platform

What it does better: Reachability analysis, license scanning, SBOM export, policy gates in CI — none of which this does.

Where this fits: They price for a security team. This is a weekly page and an email for a team that has neither, and it is honest about the versions it cannot resolve rather than resolving them optimistically.

`npm audit` / `pip-audit` in CI

What it does better: Runs against exactly what is installed, which is the most accurate input there is.

Where this fits: It reports at build time, to whoever reads build logs. There is no weekly view across services and no record of what you dismissed and why. Run both — this does not replace it.

The one thing this does differently

Every tool on this page prints a verdict for every dependency. When the manifest does not pin a version, some of those verdicts are produced by resolving the range against the registry as it stands right now. That is a reasonable engineering choice and it is not what we do: we answer unknown, say which of four reasons it is, and tell you that uploading the lockfile turns it into a real answer.

If you already commit lockfiles for everything, this difference is invisible to you and you should pick on other grounds.