Transitive dependency

What it means

A transitive dependency is a library your project needs only because one of your direct dependencies needs it. You never chose it, and it may never appear in your own manifest, yet it is installed and runs in your application.

Dependencies nest. You add one package, it depends on five more, and those depend on others. A modest project can end up with hundreds of libraries, most of them transitive.

Why it matters

A flaw in a library three layers down is still a flaw in your product. Many well-known incidents involved a deeply buried library that few teams knew they used, and finding out meant searching every project for it.

Transitive dependencies are also where a malicious package can slip in. You review the libraries you pick, but rarely the libraries they pick. Customers asking for an SBOM expect the whole tree.

How it shows up

You meet them in lockfiles and dependency trees. In npm, npm ls --all prints the full tree. Other ecosystems have similar commands. Software composition analysis reads these and matches versions against known flaws.

The mistakes repeat. Teams only watch direct dependencies. They cannot update a buried library because the parent pins an old version. Fixes need an update to the parent, an override, or a replacement. Commit lockfiles, update regularly, and work out which flaws are actually reachable.