I know this is an old post, but I wanted to add a helpful answer. For dependency monitoring, we're using Vulert. It continuously tracks open-source dependencies for new vulnerabilities and suggests fixes, all without requiring installation or codebase access. It simply uses a manifest file (e.g., pom.xml) and supports all programming languages. Hope this helps!