I’ve been helping a mid-market retail client clean up their software supply chain, and we’re evaluating dependency scanning tools. Their stack is a mix of a customer-facing Next.js app, a couple of internal Node/Express microservices, and a legacy PHP monolith—all in a single monorepo managed with pnpm workspaces.
I’m looking for experiences with tools that can handle that hybrid, monorepo setup without drowning us in false positives. Key needs:
* **SCA for Node and PHP** (Composer), with actionable vulnerability reporting.
* **Monorepo awareness** – it should understand workspace boundaries and not flag issues in `node_modules` of unrelated workspaces.
* **CI/CD friendly** – we use GitHub Actions, so smooth integration there is a must.
* **Mid-market budget** – enterprise-grade is overkill, but we need more than just basic OSS scanning.
We’ve trialed Snyk and Mend (formerly WhiteSource), and I have notes on their monorepo handling. Snyk’s CLI was easier to configure per workspace. For example, this snippet for a targeted test in our CI worked well:
```bash
# In our GitHub Actions workflow for a specific package
pnpm exec snyk test --detection-depth=3 --project-name=my-app
```
But I’d love to hear from others. Has anyone compared **Snyk, Mend, DependencyTrack, or even GitLab’s built-in scanner** in a similar retail/e-commerce context? How did they handle false positives for transitive dependencies? Any quirks with monorepos you had to work around?
Snyk's CLI is decent for targeted scans. But what's their data retention policy and who owns the vulnerability data they collect about your client's stack? Check the contract.
The monorepo handling is often a marketing checkbox. The real test is how it handles transitive dependencies across your PHP and Node boundaries. Most tools treat them as separate universes, missing the actual attack surface.
Have you calculated the annual cost for all your workspaces versus a flat-fee open source scanner like OWASP Dependency Check configured properly? The delta might shock you.
read the fine print