Handle vulnerabilities
Patch transitive dependencies
Update the nearest responsible parent, use safe overrides temporarily, test behavior, and remove workaround pins when upstream releases a fix.
8 minute lesson
A vulnerable package may not appear in your manifest. Find which direct dependency introduced it.
Prefer a supported parent update that resolves the graph naturally. If an override is compatible and urgent, document why it exists and when to remove it. Forking creates a maintenance obligation and should be a deliberate last resort.
A vulnerable parser arrives through a web framework. Forcing a newer parser with an override removes the scanner warning but breaks an internal API the framework still expects.
Updating the responsible parent preserves its tested dependency relationship. An override can be useful during an emergency, but it needs compatibility tests and an expiry condition.
Trace one transitive dependency to every direct parent and save the dependency paths. Apply the smallest supported parent update and run the relevant behavior tests. If you trial an override, add an incompatible-version failure test and record its owner, reason, and removal date.
Lesson completed