A transitive dependency is a package your project depends on indirectly, because one of your direct dependencies requires it. You never chose it and may never have heard of it, yet it ships in your application and can carry vulnerabilities like any other code.
Direct versus transitive
Say your project lists library A. Library A needs B, and B needs C. A is a direct dependency. B and C are transitive. C is two levels down, sometimes called a deep dependency.
Your manifest file shows A. Your lockfile and your SBOM show A, B and C. The gap between those two views is where surprises live.
Why they matter
- There are usually far more of them than direct dependencies, so most of what you ship is code you did not pick.
- A vulnerability in C affects you even though your manifest never mentions C.
- Fixing it is awkward: you often cannot upgrade C yourself, because A decides which version of C is allowed.
How to see them
Use your package manager's tree or list command to print the full graph, and read your lockfile. A scanner that reads lockfiles will include transitive packages. One that reads only the manifest will miss them, so check which kind you have.
Options when a transitive package is vulnerable
- Upgrade the direct dependency that pulls it in, if a newer release uses a fixed version.
- Use your package manager's override or resolution feature to force a fixed version, then test carefully, since the parent library was not built against it.
- Replace the direct dependency if it is unmaintained.
- Check reachability. If your code never reaches the flawed function, the urgency drops.
Keeping the graph small
Every new direct dependency brings its own tree. Before adding a library, look at how much it pulls in, and ask whether a few lines of your own code would do. Smaller graphs are easier to scan and audit.
Safeguard's dependency scanning covers transitive packages and shows how a vulnerable one entered. A free scan is at gold.safeguard.sh/scan.
Quick check
Can I ignore transitive dependencies if my direct ones are clean?
No. A direct dependency can be clean while one of its own dependencies is not.
Why can I not just upgrade the vulnerable transitive package?
The parent library may restrict which versions it accepts. An override can work, but it needs testing.
Last reviewed: 19 October 2026.
