Ask your package manager for the reverse path. In npm use npm explain or npm ls with the package name, in Cargo use cargo tree with the invert option, and in .NET use dotnet nuget why. Each shows which direct dependency brings in the vulnerable package, which tells you what to upgrade.
Definitions
Reverse dependency. A package that depends on a given package.
Dependency path. The chain from your project to the vulnerable package.
Closest parent. The direct dependency at the top of that chain.
Commands
| Ecosystem | Command | Result |
|---|---|---|
| npm | npm explain name | A bottoms up view of why a package is in the tree |
| npm | npm ls name | Paths leading to that package |
| Cargo | cargo tree -i name | Packages that depend on the named one |
| .NET | dotnet nuget why project name | Why a transitive package is in the graph |
| Maven | dependency:tree with the includes filter | Only matching artifacts and their parents |
npm explain lodash
cargo tree -i syn
mvn dependency:tree -Dincludes=org.apache.*:*
In a Cargo workspace, the invert option shows reverse dependencies within the current member crate unless you add the workspace option.
Steps
- Note the vulnerable package, its current version and the fixed version.
- Run the reverse path command for your ecosystem.
- Identify the direct dependency at the top of each path. There may be several.
- Check whether that parent has a newer version that depends on the fixed package.
- If it does, upgrade the parent and re-scan.
- If it does not, try the next parent along the path.
- As a last step, add the fixed version as a direct requirement or override, and write down why.
Microsoft's guidance for .NET follows this order: upgrade the package closest to your direct reference first, and then, as a later step, pin the transitive package. It also warns that a direct pin should be removed once a parent update makes it unnecessary.
Options when no parent update exists
| Option | Upside | Downside |
|---|---|---|
| Pin or override the fixed version | Fast fix | Can break the parent, needs testing |
| Ask the parent project for an update | Fixes it for everyone | Slow |
| Replace the parent | Clean result | Migration work |
| Accept the risk with a reason | No change risk | Needs review dates |
Try it yourself
Click through it at your own pace, or open it full screen.
Pick a finding and see which upgrade clears it.
Quick check
What if two parents pull in the same vulnerable package?
Fix both paths, or add one override that covers the build. Re-scan to confirm.
Is an override safe?
It can be, but run your tests. The parent was built against a different version.
Safeguard shows the dependency path for each finding and can open fix pull requests when you turn autonomous remediation on, which is off by default. Try a free scan.
Sources
- npm docs, npm ls
- Cargo book, cargo tree
- Microsoft Learn, Auditing package dependencies
- Apache Maven Dependency Plugin, dependency:tree
Last reviewed: 19 October 2026.
