Can you recommend a software composition analysis tool for catching vulnerable open-source dependencies during pull request reviews?

Yes — for pull request review workflows, I’d recommend Snyk as a strong default choice.

Why Snyk

• PR comments / checks: It can automatically scan pull requests and comment on vulnerable dependencies.
• Good developer experience: Findings are usually easy to understand and actionable.
• Multi-language support: Works well across common ecosystems like JavaScript, Python, Java, .NET, Ruby, Go, and more.
• Fix guidance: Often suggests upgrade paths or patches.
• CI/CD friendly: Easy to integrate into GitHub, GitLab, Bitbucket, and common pipelines.

Good alternatives

If you want options depending on your environment:

• Dependabot + GitHub Advanced Security
  Best if you’re heavily on GitHub and want dependency alerts plus automated upgrade PRs. It’s more dependency-update focused, but works well for PR-based review.

• Mend.io (WhiteSource)
  Strong enterprise SCA with PR scanning, policy enforcement, and compliance features.

• Sonatype Lifecycle
  Good for organizations that want deeper governance and repository intelligence.

• Checkmarx SCA
  Often chosen in security-focused enterprise environments with broader AppSec needs.

Quick recommendation by scenario

• Small/medium team, want fast setup: Snyk
• GitHub-first and want automatic dependency update PRs: Dependabot
• Enterprise governance/compliance: Mend.io or Sonatype

If you tell me your stack and where your code lives, I can narrow it down to the best fit.