Generally these scanners can have two possible opinions about a dependency: "contains security bug" and "don't know" - they can't prove absence of vulnerabiliti

Generally these scanners can have two possible opinions about a dependency: "contains security bug" and "don't know" - they can't prove absence of vulnerabilities. So if tool A flags a dependency and tool B doesn't, both are likely right, and you should treat it as a flagged dependency.