To find a zero-day in a transitive dependency, build the full dependency tree from your lock files or build output, search it for the affected package and version range, then trace the path to the direct dependency that pulls it in. Check container images and bundled artifacts too, because source files miss them.
What transitive means
A direct dependency is one you declare. A transitive dependency is one your dependency needs, or one that dependency needs in turn. You never chose it, may never have heard of it, and still ship it. A single direct package can bring in dozens of others.
Step by step
- Get the advisory facts. Package name, ecosystem, affected range.
- Generate the resolved tree. Use the package manager's own listing command, such as an npm or Maven dependency tree, or read the lock file, which records exact resolved versions.
- Search the tree. Look for the package name across all repositories, not just the one that raised the alert.
- Record the path. Note which direct dependency brings it in. That is where your fix will likely go.
- Check built artifacts. Compare against container images and packaged files, since these may include versions that differ from source.
Why the path matters
The fix options depend on the path.
| Situation | Typical fix |
|---|---|
| Parent has released a version with a fixed child | Update the parent |
| Parent has not updated | Override or pin the child version if the package manager supports it |
| Child cannot be fixed or removed | Mitigate and watch for a parent release |
Overrides can break compatibility, so test them. Note them in the repository so the next developer knows why they are there.
Multiple versions of one package
Large projects often resolve the same package to more than one version. An advisory may hit one copy and not another. List every resolved version and its path, not just the first match.
Reachability helps you rank
After you have the list, reachability analysis shows whether your code can call the vulnerable function. It helps rank the work. It does not remove the need to update, because code paths change.
Try it yourself
Click through it at your own pace, or open it full screen.
Compare the full list of findings with the reachable ones.
Where Safeguard fits
Safeguard's SBOM and dependency scanning resolve transitive packages, and its reachability analysis ranks findings by whether the vulnerable code is called. Try a free scan on a repository you own.
Quick check
Can I just update the library named in the advisory?
Only if you control it. For a transitive package you usually update the parent or override the child version, then test.
Do lock files list transitive packages?
Yes, most lock files record every resolved package and version, which makes them a reliable starting point in a repository.
Last reviewed: 19 October 2026.
