A transitive dependency is one you did not choose, pulled in by something you did. First try upgrading the parent package that brings it in. If the parent has not moved, force the safe version with the tool's own mechanism: overrides in npm, a constraints file in pip, dependencyManagement in Maven, or a constraint in Gradle.
The order to try
- Upgrade the parent. Check whether a newer release of the direct dependency already uses a fixed version.
- Force the version. Use the tool feature below, then test.
- Replace the parent. If it is abandoned, switch to a maintained alternative.
- Mitigate or accept. If none of that is possible, document the exception.
How each tool does it
| Tool | Mechanism | Behaviour worth knowing |
|---|---|---|
| npm | The overrides field in package.json | Replaces the version wherever the package appears in the tree |
| pip | A constraints file used with the c option | Limits the version only. Does not cause an install on its own |
| Maven | dependencyManagement section | Takes precedence over nearest definition mediation for transitive dependencies |
| Gradle | A constraints block, with a because message | Applies only if the module is already in the graph, and records the reason |
Maven's default rule picks the nearest definition in the tree, and if two are at the same depth, the first declaration wins. That default can leave an old version in place, which is why a managed version helps.
Examples
pip, with a constraints file that lists the fixed version:
python -m pip install -c constraints.txt -r requirements.txt
Gradle, with the reason recorded for future maintainers:
dependencies {
constraints {
implementation("commons-codec:commons-codec:1.15") {
because("a parent pulls in an older version with known vulnerabilities")
}
}
}
After forcing a version
- Run the full test suite. A forced version may be newer than the parent expects.
- Rescan and confirm the finding is gone.
- Add a comment or because message with the advisory ID and a date to revisit.
- Remove the override when the parent releases a fix, or it will hold you back later.
- Regenerate the SBOM so it shows the real version.
Quick check
Is forcing a transitive version risky?
It can be. The parent was tested against its own version. Test the combination, and prefer the smallest version jump that clears the advisory.
Does a pip constraint install the package?
No. Per the pip documentation, a constraints file controls which version is installed, not whether it is installed.
Where Safeguard fits
Safeguard's SBOM and dependency scanning shows the path from your project to a vulnerable transitive package, and its fix pull requests can propose the upgrade for review. Try the free scan.
Sources
- pip documentation, constraints files, pip.pypa.io.
- Apache Maven, Introduction to the Dependency Mechanism, maven.apache.org.
- Gradle documentation, dependency constraints, docs.gradle.org.
- npm overrides behaviour is as described in npm documentation; confirm syntax for your npm version.
Last reviewed: 19 October 2026.
