Know What Every Dependency Brought In
Risk can sit anywhere in your software, including in components acquired by third-party suppliers. Third-party software often includes code from other suppliers, and that code often pulls in code from still more suppliers. Each layer can carry its own vulnerabilities and licenses, and the deeper it sits, the harder it is to see.
Today, Manifest Cyber is launching Transitive Dependencies in The Manifest Platform, available in SaaS, self-hosted, and air-gapped deployments. The Components tab on every asset now shows how each component entered your software. You can see which components you depend on directly, which ones arrived through another component, and which direct dependency introduced them.
A flat list of components can show you that a vulnerable library is in your product. It can’t show you how it got there, or what you need to update to remove it.
Why We Built This
A direct dependency is a component your team chose and declared. A transitive dependency is everything a component needs to run, plus everything those components need, all the way down the chain.
When a vulnerability in a widely used library goes public, many affected teams find they never added that library themselves. It arrived through frameworks and packages that depend on it. Security leaders then face two questions. Do we have it? And if so, which supplier do we reach out to for a remediation? A flat component list answers the first. It cannot answer the second.
What Transitive Dependencies Does
The new view lives on the Components tab of each asset. Open an asset and you see:
- Relationship labels. Every component is marked Direct, Transitive, or Unknown. Direct means the software the SBOM describes depends on it directly. Transitive means another component introduced it, one or more levels down.
- A two-layer view. Direct dependencies sit at the top level. Expand one to see every transitive component it brings in, flattened into a single list no matter how deep each one sits.
- Introduced by. Each transitive component names the direct dependency, or dependencies, that pulled it in. A library reached through three direct dependencies appears under all three. A component that is both direct and transitive is labeled Direct and still appears under each dependency that brings it in.
- A relationship filter. Show Direct, Transitive, or Unknown components in any combination.
- Search that keeps context. When a search matches a transitive component, it appears under the direct dependency that introduced it, so you never lose the path.
- The columns you already use. Version, license, supplier, and vulnerabilities stay on every row, nested rows included.
How It Works
The SBOM is the ground truth. Both CycloneDX and SPDX can record which components depend on which. When you upload an SBOM, Manifest reads that dependency data, builds the graph, and labels every component once, at processing time.
Manifest does not guess at missing links or enrich the graph from outside sources. If a relationship is in your SBOM, you see it. If it is not, the component is labeled Unknown rather than placed somewhere it may not belong. For a security team defending its findings to an auditor or a program office, that distinction matters. Every relationship on screen traces back to a file you control.
Built for SaaS, Self-Hosted, and Air-Gapped Environments
Transitive Dependencies works the same wherever you run The Manifest Platform. It reads only the uploaded SBOM and makes no network calls, so in a self-hosted or air-gapped install, every relationship is built inside the perimeter. Defense, government, and critical infrastructure teams that cannot send data outside their environment get the same view as SaaS customers.
What Comes Next
Transitive Dependencies is available now in The Manifest Platform for SaaS, self-hosted, and air-gapped customers. For setup details and labeling rules, read Understanding Direct and Transitive Dependencies in the Manifest docs.
The component list told you what was in your software. Now it tells you how each component got there and which dependency you own that controls it. The next time a buried library makes headlines, the question will not be where it came from. The answer will already be on the screen.
See Transitive Dependencies in action. Get a demo.
