An SBOM-based Component Analysis platform that tracks software dependencies and their known vulnerabilities across an organization's projects.
4.4K+35 this week852JavaApache-2.0Well maintainedUpdated yesterday
1 alternative
Best open-source alternatives to Black Duck (2026)
Looking for a free, open-source alternative to Black Duck? These 1 projects can replace it. Each one passed our quality screening and is explained in plain words, so you can compare stars, license and maintenance at a glance.
Quick comparison
| Project | Stars | License | Last commit |
|---|---|---|---|
| DependencyTrack/dependency-track | ★ 4.4K | Apache-2.0 | yesterday |
FAQ
- Is there a free, open-source alternative to Black Duck?
- Yes. The most popular open-source alternatives to Black Duck on Repolode are dependency-track.
- Which Black Duck alternative should I choose?
- dependency-track has the most GitHub stars and is released under Apache-2.0. Compare the license and last commit of each option in the table above before choosing.
How this list is made: AI reads each project's documentation to match it with products it can replace, every project passes our quality screening, and the list is ranked by GitHub stars. Stars updated Nov 5, 2026. How Repolode works