Sometimes. Update tools edit the dependencies you declare by default. Indirect ones are updated only where the tool and the ecosystem support it, or when a lockfile refresh moves them. Ask which ecosystems are covered, whether a fix can be opened for an indirect package, and what happens when a parent pins it.
Direct, indirect and what a tool sees
A direct dependency is one you list in a manifest. An indirect, or transitive, dependency is one your dependencies need. Most of a modern tree is indirect, and many advisories land there.
An update tool can only change what it can reach. For a direct dependency it edits your manifest. For an indirect one it usually cannot edit anything you wrote, so it has to change the lockfile, or add an override, or update the parent that pulls the package in.
What the documentation says
The options reference of one major bot has a setting to allow updates by dependency type: direct, indirect, all, production or development. For direct, it covers all explicitly defined dependencies. For indirect, it lists the package managers that support it: bundler, pip, composer, cargo, go modules and uv. The setting for all adds the dependencies of direct dependencies for those same managers. That tells you something important: indirect support is a per-ecosystem list, not a universal feature.
The second bot's documentation shows another shape of the problem. Its experimental option for an open vulnerability database says you get alerts only for direct dependencies. Its lockfile maintenance feature, by contrast, refreshes the whole lockfile within your declared constraints, which moves indirect packages along.
| Mechanism | Reaches indirect packages? |
|---|---|
| Normal version update pull request | Mostly direct only |
| Allow rule with indirect type | Only for supported package managers |
| Lockfile refresh | Yes, within declared ranges |
| Manual override or resolution | Yes, but you maintain it |
| Update of the parent package | Yes, if the parent has a fixed release |
Questions to ask any tool
- For which ecosystems can you open a pull request for an indirect dependency? Ask for the list.
- Does security coverage include indirect packages, or only direct ones?
- If the parent pins the vulnerable version, what does the tool do? Does it open an override, wait, or nothing?
- Does it show why an indirect package is in the tree, so a reviewer knows which parent to chase?
- Does it refresh lockfiles on a schedule?
What to do when the tool cannot reach it
Work upward. Find the direct dependency that brings in the package and check whether a newer release of it updates the indirect one. If not, check whether your package manager supports overrides, and use one with a comment and an end date. As a last step, replace the parent or ask its maintainer. Our post on how to remediate transitive dependency vulnerabilities walks through these in order.
Why reachability matters here
Indirect packages produce the largest share of alerts and the least obvious fixes. Before spending a week on an override, check whether your code can even reach the vulnerable function. If it cannot, you can schedule the fix instead of dropping everything.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the findings and watch how many flagged packages drop away once reachability is applied.
Quick check
Why did my tool ignore a vulnerable indirect package?
It may only support direct dependencies for that ecosystem or data source. Check the documented coverage.
Is an override a good permanent fix?
No. Treat it as a bridge, with a comment and a date, until the parent package updates.
Safeguard reads manifests and lockfiles into an SBOM that includes indirect packages, and reachability analysis shows which flagged ones your code calls. Fix pull requests are off by default, with every category on Manual. Try a free scan.
Sources
- Code host documentation: update bot options reference, dependency types
- Update bot documentation: configuration options, vulnerability alerts and lockfile maintenance
Last reviewed: 19 October 2026.
