Ask HN: Best approach to dependency vulnerability scanning in CI?

A user on Hacker News is seeking advice on the best approach to scanning for dependency vulnerabilities in continuous integration. They are looking for automated tools that can detect vulnerabilities and generate software bills of materials without requiring access to source code. The user is inquiring about how others are currently securing their software dependencies. The question has been posted to gather feedback and suggestions from the community.