docs: add transitive dependencies section to Security and risk management by LipeGheno · Pull Request #2676 · codacy/docs

LipeGheno · 2026-05-22T10:38:11Z

Summary

Adds a new Transitive dependencies subsection inside the existing Dependencies section of the Security and risk management page
Explains what transitive dependencies are and how Codacy surfaces them as findings labelled Transitive Dependency in the Findings tab
Documents how to read the import chain (repository → direct dep → … → vulnerable package → CVE), including the upgrade label behaviour
Covers the "no upgrade available" scenario and current limitations
Adds a screenshot (security-risk-management-transitive-chain.png) showing the chain on a finding card

Test plan

Verify the new section renders correctly on the docs site
Confirm the screenshot displays properly
Check all internal anchor links resolve (#transitive-dependencies)

🤖 Generated with Claude Code

…ment Documents the transitive dependency import chain feature in the Dependencies section, including how findings are labelled, how to read the chain, upgrade labels, cases where no upgrade is available, and current limitations. Adds screenshot of the chain in the Findings tab. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-actions · 2026-05-22T10:39:00Z

Overall readability score: 54.21 (🟢 +0)

File	Readability
managing-security-and-risk.md	59.11 (🟢 +1.04)

View detailed metrics

🟢 - Shows an increase in readability
🔴 - Shows a decrease in readability

File	Readability	FRE	GF	ARI	CLI	DCRS
managing-security-and-risk.md	59.11	36.89	9.69	12.7	12.7	6.44
	🟢 +1.04	🟢 +0.2	🟢 +0.19	🟢 +0.2	🟢 +0.12	🟢 +0.07

Averages:

	Readability	FRE	GF	ARI	CLI	DCRS
Average	54.21	43.1	10.91	12.31	12.24	8.01
	🟢 +0	🟢 +0	🟢 +0	🟢 +0	🟢 +0	🟢 +0

View metric targets

Metric	Range	Ideal score
Flesch Reading Ease	100 (very easy read) to 0 (extremely difficult read)	60
Gunning Fog	6 (very easy read) to 17 (extremely difficult read)	8 or less
Auto. Read. Index	6 (very easy read) to 14 (extremely difficult read)	8 or less
Coleman Liau Index	6 (very easy read) to 17 (extremely difficult read)	8 or less
Dale-Chall Readability	4.9 (very easy read) to 9.9 (extremely difficult read)	6.9 or less

codacy-production · 2026-05-22T10:39:22Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

gemini-code-assist

Code Review

This pull request adds a new 'Transitive dependencies' section to the documentation, detailing how import chains are displayed for vulnerabilities found in indirect packages. The feedback suggests improving sentence flow by adding a comma and ensuring terminology consistency by using 'Software Composition Analysis (SCA)' instead of 'dependency scanning'.

gemini-code-assist · 2026-05-22T10:39:43Z

+
+#### When no upgrade is available
+
+If no package in the chain has a patched release yet, the chain shows the full path without an upgrade label. In that case the vulnerability cannot be resolved by a version bump alone; you may need to wait for an upstream fix, apply a workaround, or accept the risk per your organization's policy.


Add a comma after "In that case" to improve the readability and flow of the sentence.

Suggested change

If no package in the chain has a patched release yet, the chain shows the full path without an upgrade label. In that case the vulnerability cannot be resolved by a version bump alone; you may need to wait for an upstream fix, apply a workaround, or accept the risk per your organization's policy.

If no package in the chain has a patched release yet, the chain shows the full path without an upgrade label. In that case, the vulnerability cannot be resolved by a version bump alone; you may need to wait for an upstream fix, apply a workaround, or accept the risk per your organization's policy.

gemini-code-assist · 2026-05-22T10:39:43Z

+
+#### Limitations
+
+- The import chain is shown only for findings that come from dependency scanning. Findings from other scan types (container scanning, app scanning) do not show a chain.


To maintain consistency with the "Scan types" table (line 338) and other sections of the documentation (e.g., line 184), use the formal term "Software Composition Analysis (SCA)" instead of "dependency scanning".

Suggested change

- The import chain is shown only for findings that come from dependency scanning. Findings from other scan types (container scanning, app scanning) do not show a chain.

- The import chain is shown only for findings that come from Software Composition Analysis (SCA). Findings from other scan types (container scanning, app scanning) do not show a chain.

codacy-production

Pull Request Overview

The documentation changes are technically sound and follow the project's quality standards according to Codacy. However, there is a critical gap: the image security-risk-management-transitive-chain.png referenced in the new section is not included in this pull request. This omission will cause a broken image link in the production documentation and fails to meet the acceptance criterion requiring a UI screenshot. There are also two minor suggestions for spelling and punctuation to maintain consistency with the existing documentation.

About this PR

The PR description mentions adding a screenshot, and the Markdown references it, but the image file 'security-risk-management-transitive-chain.png' is not included in the provided code changes. Please ensure the image is added to the repository.

Test suggestions

Verify that the 'Transitive dependencies' section and its subsections render correctly on the documentation site.
Ensure the image file 'images/security-risk-management-transitive-chain.png' exists at the specified path.
Check that the anchor link '#transitive-dependencies' is functional and correctly indexed.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that the 'Transitive dependencies' section and its subsections render correctly on the documentation site.
2. Ensure the image file 'images/security-risk-management-transitive-chain.png' exists at the specified path.
3. Check that the anchor link '#transitive-dependencies' is functional and correctly indexed.

_{TIP Improve review quality by adding custom instructions}
_{TIP How was this review? Give us feedback}

codacy-production · 2026-05-22T10:40:13Z

+
+Open the **Findings** tab under **Security and risk management**. Findings caused by a transitive dependency are labelled **Transitive Dependency** in the header.
+
+![Security and risk management transitive dependency finding](images/security-risk-management-transitive-chain.png)


_{🟡 MEDIUM RISK}

The image 'security-risk-management-transitive-chain.png' is referenced but not included in the PR, which will result in a broken image in the rendered documentation.

codacy-production · 2026-05-22T10:40:13Z

+
+#### When no upgrade is available
+
+If no package in the chain has a patched release yet, the chain shows the full path without an upgrade label. In that case the vulnerability cannot be resolved by a version bump alone; you may need to wait for an upstream fix, apply a workaround, or accept the risk per your organization's policy.


_{⚪ LOW RISK}

Nitpick: Add a comma after the introductory phrase.

Suggested change

If no package in the chain has a patched release yet, the chain shows the full path without an upgrade label. In that case the vulnerability cannot be resolved by a version bump alone; you may need to wait for an upstream fix, apply a workaround, or accept the risk per your organization's policy.

If no package in the chain has a patched release yet, the chain shows the full path without an upgrade label. In that case, the vulnerability cannot be resolved by a version bump alone; you may need to wait for an upstream fix, apply a workaround, or accept the risk per your organization's policy.

codacy-production · 2026-05-22T10:40:13Z

+
+#### Where you see it
+
+Open the **Findings** tab under **Security and risk management**. Findings caused by a transitive dependency are labelled **Transitive Dependency** in the header.


_{⚪ LOW RISK}

Nitpick: Use the American English spelling for consistency with the rest of the documentation.

Suggested change

Open the **Findings** tab under **Security and risk management**. Findings caused by a transitive dependency are labelled **Transitive Dependency** in the header.

Open the **Findings** tab under **Security and risk management**. Findings caused by a transitive dependency are labeled **Transitive Dependency** in the header.

LipeGheno requested a review from a team as a code owner May 22, 2026 10:38

LipeGheno requested a review from lventura-codacy May 22, 2026 10:38

github-actions Bot deployed to Netlify May 22, 2026 10:39 View deployment

gemini-code-assist Bot reviewed May 22, 2026

View reviewed changes

codacy-production Bot reviewed May 22, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

docs: add transitive dependencies section to Security and risk management#2676

docs: add transitive dependencies section to Security and risk management#2676
LipeGheno wants to merge 1 commit into
masterfrom
docs/transitive-dependencies-section

LipeGheno commented May 22, 2026

Uh oh!

github-actions Bot commented May 22, 2026

Uh oh!

codacy-production Bot commented May 22, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot May 22, 2026

Uh oh!

gemini-code-assist Bot May 22, 2026

Uh oh!

codacy-production Bot left a comment

Uh oh!

codacy-production Bot May 22, 2026

Uh oh!

codacy-production Bot May 22, 2026

Uh oh!

codacy-production Bot May 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant


		#### When no upgrade is available

		If no package in the chain has a patched release yet, the chain shows the full path without an upgrade label. In that case the vulnerability cannot be resolved by a version bump alone; you may need to wait for an upstream fix, apply a workaround, or accept the risk per your organization's policy.


		#### Limitations

		- The import chain is shown only for findings that come from dependency scanning. Findings from other scan types (container scanning, app scanning) do not show a chain.


		Open the Findings tab under Security and risk management. Findings caused by a transitive dependency are labelled Transitive Dependency in the header.

		![Security and risk management transitive dependency finding](images/security-risk-management-transitive-chain.png)


		#### Where you see it

		Open the Findings tab under Security and risk management. Findings caused by a transitive dependency are labelled Transitive Dependency in the header.

Conversation

LipeGheno commented May 22, 2026

Summary

Test plan

Uh oh!

github-actions Bot commented May 22, 2026

Uh oh!

codacy-production Bot commented May 22, 2026

Up to standards ✅

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot May 22, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 22, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot left a comment

Choose a reason for hiding this comment

Pull Request Overview

About this PR

Test suggestions

Uh oh!

codacy-production Bot May 22, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot May 22, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot May 22, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant