Act on the direct dependency that pulls in the vulnerable package, not on the deep package itself. Find the dependency path, check whether your code reaches the flawed function, then upgrade or replace the parent. Overriding a transitive version by hand is a last resort that needs tests.
Why the parent is the right place
The OWASP Vulnerable Dependency Management cheat sheet states the approach plainly: if the vulnerability affects a transitive dependency, the action is taken on the direct dependency of the project, because acting on a transitive dependency often affects the stability of the application. Acting on the deep package requires the team to fully understand the communication from the first level dependency down to the affected one, which the guidance calls very time consuming.
For a payments service, stability is the point. You do not want an emergency version override quietly changing behaviour in a library that handles money.
Step by step
- Find the path. Use your package manager's tree command or your inventory to see which direct dependency brings in the vulnerable package. OWASP notes that IDEs and dependency management systems can identify the first level dependency using it.
- Read the advisory for the affected function and conditions.
- Check reachability. Does your code, or the direct dependency's behaviour you rely on, call the flawed function? A flaw in code that never runs has a different urgency than one on your payment path.
- Look for a newer version of the direct dependency. That is usually the clean fix.
- Run your tests, ideally including the features that use the dependency. OWASP's patch case assumes automated unit, integration or functional tests exist so you can confirm the feature still works.
- If no parent upgrade exists, consider the cases in the guidance: workaround, replacing the parent, or an override with tests.
Choosing between actions
| Option | When it fits | Watch out for |
|---|---|---|
| Upgrade the direct dependency | A newer parent resolves a fixed child | Breaking changes in the parent |
| Replace the direct dependency | Parent is abandoned | Code changes and retesting |
| Override the transitive version | Parent is slow and the child fix is compatible | Subtle behaviour changes, drift from what the parent was tested with |
| Isolate or disable the feature | No fix, flaw in an optional path | Product impact |
| Accept and track | Not reachable, low impact | Needs an owner and an expiry date |
Pin and verify what you ship
Lockfiles matter here. OWASP's supply chain guidance recommends limiting dependencies to specific, previously verified versions, commonly through lockfiles. After any change, confirm the lockfile shows the expected child version, and let a dependency review check on the pull request show the difference, including indirect packages, as GitHub's documentation describes.
Record the reasoning
When you decide a transitive flaw is not reachable, write down how you checked. Scanners will keep flagging it, and a future engineer needs to see why you held back. OWASP suggests scoping any ignore entry to the specific advisory and not to the whole dependency.
A note on noise
Many alerts for indirect packages never reach your code. That is not a reason to ignore the category, because some of them do. It is a reason to rank by reachability and exposure rather than by the number of alerts. Payment paths, authentication and anything that handles untrusted input should be reviewed first.
Where Safeguard fits
Safeguard's SBOM and dependency scanning shows the dependency tree with direct and indirect packages, and its reachability analysis helps show which flagged flaws your code can reach. A free scan is available at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Walk through the check and see what separates a flaw that is present from one that is exploitable.
Quick check
Can I just override the nested version?
Sometimes, but it can change behaviour the parent was not tested with. OWASP points to acting on the direct dependency first.
How do I find which parent brings in a package?
Use your package manager's dependency tree command or your inventory tool, and check the path to the flagged package.
Sources
- OWASP Vulnerable Dependency Management Cheat Sheet
- OWASP Software Supply Chain Security Cheat Sheet
- GitHub Docs, About dependency review
Last reviewed: 19 October 2026.
