---
title: "Transitive dependency"
description: "A transitive dependency is a package your software needs indirectly because one of its direct dependencies requires it. If you add package A and…"
canonical_url: "https://cloudsmith.com/resources/glossary/transitive-dependency"
last_updated: "2026-10-16T14:52:06Z"
---
# Transitive dependency

## What Is a Transitive Dependency?

A transitive dependency is a package your software needs indirectly because one of its direct dependencies requires it. If you add package A and A depends on B, then B is a transitive dependency of your project.

## Direct vs Transitive Dependencies

```json
{
  "_key": "b615ae90-14a",
  "_type": "tableBlock",
  "firstRowIsHeader": true,
  "markDefs": null,
  "table": {
    "rows": [
      {
        "_key": "cda02fc6-8f1",
        "_type": "tableRow",
        "cells": [
          "Type",
          "Description"
        ]
      },
      {
        "_key": "c99856d3-96b",
        "_type": "tableRow",
        "cells": [
          "Direct",
          "Declared by you in a manifest file"
        ]
      },
      {
        "_key": "0ee3dce2-7e8",
        "_type": "tableRow",
        "cells": [
          "Transitive",
          "Pulled in by a direct dependency or by another transitive one"
        ]
      }
    ]
  }
}
```

## Why Transitive Dependencies Matter

Most of the code in a modern application comes from transitive dependencies. They create several challenges:

- Vulnerabilities hidden several layers down
- License obligations no one reviewed
- Version conflicts between packages
- Maintainers you never chose to trust

You inherit the risk of everything in the tree.

## How to Manage Transitive Dependencies

Lock files record the exact version of every package in the tree. An SBOM lists them for audit. Scanners and policy checks should evaluate the full tree, not just the manifest, and tools can override a vulnerable transitive version when a fix exists.

## Final Thought

You cannot govern what you cannot see. Visibility into transitive dependencies is the foundation of dependency control.

## Frequently asked questions

### How many transitive dependencies does a typical project have?

Often many times more than direct ones. A handful of direct packages can pull in hundreds of indirect ones.

### Can I remove a transitive dependency?

Not directly. You can replace or upgrade the direct dependency that requires it, or use an override where your tool supports it.

### Do vulnerability scanners check transitive dependencies?

Most do, but coverage varies, so confirm that your scanner reads lock files or resolved trees.

### Does an SBOM include transitive dependencies?

A complete SBOM should. Listing only direct dependencies leaves most of the software unaccounted for.