The landscape hasn't changed much in the last few years. The only thing I've seen is DevAudit. I've experimented with the Visual Studio extension, as well as its related command line utility, but haven't moved forward with using either.
A few of the vulnerabilities it reported felt just wrong, but it did also surface real ones too. The command line tool was frustrating, as it didn't produce structured data that was easily usable in a CI task.
In the commercial realm, Black Duck claim to have something comprehensive in this space. It looks really rather expensive though (call for pricing...)