Not every dependency in your project is one you chose directly. Most are pulled in by other packages. Understanding the difference between direct and transitive dependencies is key to reading a drift report. This article explains it for developers and risk-conscious leaders.
Overview
- Direct dependencies are the packages you explicitly declare in your manifest — the ones you chose and control.
- Transitive dependencies are the packages your direct dependencies pull in, often several layers deep. You didn't ask for them by name, but they ship in your build.
In most projects, transitive dependencies vastly outnumber direct ones, and they carry just as much drift and security risk.
How Vibgrate sees both
Manifests list your direct dependencies; lockfiles record the full resolved tree, including every transitive package and its exact version. Vibgrate reads both, so a scan accounts for the complete graph, not just the names you wrote down:
vg
Why transitive dependencies matter
- Drift hides downstream — a current direct dependency can still drag in outdated transitive packages.
- Security exposure — a vulnerable transitive package affects you even though you never named it.
- Upgrade ripple — bumping one direct dependency can shift many transitive versions at once.
What you can and can't change directly
You control direct dependencies by editing your manifest. Transitive versions usually change as a consequence of upgrading the direct dependency that pulls them in, or via your package manager's resolution rules. Knowing which is which tells you where to act: to clear transitive drift, you typically upgrade the direct parent.
Seeing the dependency graph
Vibgrate's dependency-graph analysis inspects the lockfile for issues like duplicate packages and phantom dependencies that arise from the transitive tree. Reviewing it helps you find drift you couldn't see from the manifest alone.
Related
- See Supported ecosystems and manifests for how lockfiles are read.
- See Security and drift for transitive security exposure.
- See the Dependency Graph Scanner docs for tree-level analysis.