To run software composition analysis on a monorepo, scan from the repository root with recursive discovery so every manifest and lockfile is found, then group results by workspace. The usual failure is a tool that reads only the root lockfile and silently skips nested projects.
Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation.
Key takeaways
- Confirm the tool finds nested manifests, not only the root one.
- A skipped project is quiet. Compare the list of scanned projects with the list you expect.
- Limit scope with depth and exclude settings so test fixtures and vendored folders do not flood results.
- Update bots need each directory listed or discovered.
Why is SCA harder in a monorepo?
A monorepo can hold dozens of projects in several languages, each with its own manifest and lockfile. A scanner built for one project per repository may read the root and stop. You then get a clean report for a repository that is mostly unscanned.
How do common tools handle monorepos?
Each tool documents its own approach.
| Tool | Monorepo approach as documented |
|---|---|
| OSV-Scanner | The recursive flag walks a directory tree, for example a scan of a project directory with that flag |
| Snyk CLI | The all-projects option auto-detects supported manifests, including Yarn workspaces, and is designed to run at the monorepo root; detection depth and exclude options limit the search |
| Trivy | A filesystem scan looks for lock files in the target; the filesystem page we read does not describe subfolder handling |
| Dependabot | A directories key takes a list of locations and supports globbing; the single directory key does not |
| Renovate | Finds relevant package files automatically, including in monorepos |
Snyk's docs add that without its fail-fast option, a scan of all projects reports no vulnerabilities for projects it could not scan. Watch for that.
How do I scan only what changed?
Run the full scan on a schedule and a narrower one on pull requests. Build tools such as Nx can tell you which projects a change affects. Its affected command uses Git to find changed files, maps them to projects and adds their dependents. By default, a change to the package manager lock file marks all projects as affected, so a dependency bump triggers everything.
How do I keep results usable?
- Map each finding to the owning workspace so the right team sees it.
- Exclude fixtures, examples and vendored code by name.
- Deduplicate a vulnerable package that appears in many workspaces, then fix it once at the root where you can.
- Keep one SBOM per deployable, not one for the entire repository, if different services ship separately.
What about update pull requests?
Group them. Dependabot lets a groups setting combine updates for matching dependencies into one pull request, and its group-by dependency-name option combines updates across directories for the same ecosystem. Without grouping, each outdated dependency gets its own pull request.
To try scanning one workspace's manifest quickly, paste it into the free in-browser scan. Safeguard also offers a CLI and local runner that keeps source on your machine, and SBOM generation and import.
How to choose a monorepo SCA setup
- Does it discover nested lockfiles, or must you list each one?
- Does it report skipped projects, or fail quietly?
- Can you exclude paths and limit depth?
- Can results be grouped or filtered by workspace?
- Does your update bot cover every directory?
Frequently asked questions
Does SCA scan nested package.json files?
It depends on the tool. OSV-Scanner needs recursive mode, and Snyk needs its all-projects option.
How do I avoid scanning test fixtures?
Use the exclude features your tool offers. Snyk's exclude option matches a directory name at any level.
Should I scan on every pull request in a monorepo?
Scan affected projects on pull requests to save time, and run a full scan on a schedule. A lockfile change can affect everything.
Does Renovate support monorepos?
Its docs say it finds relevant package files automatically, including in monorepos.
Can Dependabot cover several directories?
Yes. The directories key takes a list and supports globbing and the wildcard character.
Sources
- OSV-Scanner usage
- Snyk CLI test command
- Trivy filesystem target
- GitHub Docs: dependabot.yml options
- Renovate documentation
- Nx affected
- Safeguard free scan
Last reviewed: 19 October 2026.
