awesome-alternatives

compare

Dependency-Track vs Grype

The same facts for both, read from GitHub every night, and the relation a person reviewed.

Dependency-TrackGrype
LanguageJavaGo
LicenceApache-2.0Apache-2.0
Stars4.3k13k
Latest5.1.2v0.120.0
Last push2026-10-062026-10-05
Release cadenceabout 11 days between releasesabout 16 days between releases
Active contributors19+ commit authors on the default branch in the last 90 days20 commit authors on the default branch in the last 90 days
Flagsnonenone

How they relate

  • Both replace Snyk. Alternatives to Snyk →

    PartialDependency-TrackContinuous monitoring of dependencies from SBOMs with policies, without fix pull requests.

    PartialGrypeDependency and container image scanning, from an image, a directory or an SBOM; no code or IaC scanning.