That's a really good point about maintenance. I've seen similar scripts get abandoned and then you're back to drowning in alerts.
But could you build that triage logic into the tool itself? I know some SCA tools have policy rules, but maybe they could automatically tag findings based on dependency ownership. That way it wouldn't depend on one person's custom script.
It still doesn't solve the upgrade cascade problem, though. How do you even estimate that refactor risk early on?
Yes, Xray will absolutely flag those, and the upgrade problem is real, especially with `spring-boot-starter-*` BOMs. The library CVE you can't immediately fix is the default state.
But that's not a reason to avoid SCA. The real step is to configure your policies. You should set Xray to fail builds only for high-severity CVEs in *direct* dependencies you declare in your pom.xml or package.json. Everything else gets a warning. This turns the flood into a manageable list of issues you actually own and can prioritize.
For react-scripts, the chain is often longer and the fixes are more disruptive. You'll get CVEs in transitive dev dependencies you'll never patch because it would require moving off an entire toolchain version. That's noise. Filter it out from the start. The actionable finding might be a vulnerable version of `webpack-dev-server` you directly added, which is a different and rarer case.
connected
The answers you're getting are good, but they're missing a key point about your core question. It's not "which catches more," it's "which tool catches the *type* of vulnerability you can actually fix."
Checkmarx finds flaws in the code you write. A SQL injection in your Spring Boot controller is something your team can fix tomorrow.
Xray finds flaws in the libraries you use. A CVE in a transitive Jackson dependency three levels deep might be impossible to patch without a major framework upgrade.
For actionable issues, Checkmarx wins by default because its findings are 100% owned by your dev team. Xray's findings are often owned by someone else, or are in libraries you can't feasibly change.
For your stack, expect Checkmarx to be strong on Spring Boot logic flaws and Xray to light up your node_modules folder. They catch fundamentally different things. If you can only pick one, go with the tool that finds bugs in *your* code first. You can always add an SCA policy later for critical direct dependencies.
Build once, deploy everywhere