transitive-dependencies
Safeguard articles tagged "transitive-dependencies" — guides, analysis, and best practices for software supply chain and application security.
28 articles
How Snyk calculates direct versus transitive dependency v...
Snyk splits vulnerability exposure into direct and transitive dependencies using lockfile graphs, CVE version-range matching, and path-level reachability analysis.
How Snyk handles vulnerability remediation for indirect (...
How does Snyk fix vulnerabilities buried in transitive dependencies you never directly installed? A look at dependency graphs, upgrade paths, and pinning.
Why Transitive Dependencies Are the Blind Spot in Most Vu...
Most vulnerability scans stop at direct dependencies, missing the 70-80% of your codebase that arrives transitively — where Log4Shell and other major CVEs actually hid.
Dependencies Meaning: What Are Software Dependencies?
The meaning of dependencies in software is straightforward: they are the external code your project relies on to work. Here is what that includes, why transitive dependencies matter, and how they become a security problem.
zipp in Python: Why It Is in Your Dependency Tree
The python zipp package shows up in almost every Python environment without ever being asked for by name. Here is what it does, how it got there, and the one CVE against it.
What Is a Dependency in Programming?
A dependency is any external code your software relies on to run. Here is what that really means, how direct and transitive dependencies differ, and why the concept sits at the heart of software supply chain security.
CVE-2023-1370: How a json-smart Recursion Bug Crashes Java Apps
CVE-2023-1370 lets an attacker crash any Java service that parses untrusted JSON with json-smart, using deeply nested arrays to exhaust the stack. Here is the fix.
Transitive dependency vulnerabilities explained
A vulnerability three layers deep in your dependency graph is still your problem. Here's how transitive flaws like Log4Shell hide, spread, and get fixed.
What Are Transitive Dependencies
Transitive dependencies are the packages your code never directly imports but inherits anyway — and where 84% of open source CVEs actually live.
minimatch npm: Security Review and Safe Usage
The minimatch npm package powers glob matching across the JavaScript ecosystem, and a ReDoS flaw made older versions a denial-of-service risk. Here is what to know and how to stay safe.
Lodash on npm: Prototype Pollution Risks and the Safe Version
The lodash npm package is everywhere, and older versions carry real prototype pollution CVEs. Here are the fixed versions and how to check what your tree resolves to.
npm underscore Security Review: Is It Safe to Use in 2025?
A security review of the npm underscore package, the code-injection CVE in its template function, and whether you still need it in a modern JavaScript stack.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.