When I started working with Scala, it really surprised me how the JVM world deals with dependencies (include an upstream jar directly in the project, as opposed to the Linux distro model where you use your distributor packages so you have security and bug fixes).

I'm a big fan of Dependency Check[1].

There are hosted services that can give you security scans, but if you don't have access to that (some have a cost) or you are maintaining an open source project, Dependency Check is mostly great (there are some issues every now and then with false positives, but the maintainers are great and responsive and they deal with reports very quickly).

There are also plugins for several building tools (e.g. sbt for Scala projects).

1: https://owasp.org/www-project-dependency-check/

EDIT: this may help answering the question "do I use log4j?", because transitive dependencies can be complicated!