Transitive Dependencies

Every component the platform identifies inside a binary is recorded with a linkage type describing its relationship to the file it was found in. For how the platform decides which linkage applies, see How linkage is determined, and When package data takes precedence for how a Project result becomes Vendored. We have eight types of dependency linkage we define for the detection of transitive dependencies.

Type	Description
Statically linked	Linked into the component as a static library or object file.
Dynamically linked	Linked into the component as a dynamic library.
Build	Was part of the build process like a compiler or linker.
Derived	Was derived from the component like public key parameters extracted from a private key.
Project	Is part of that project.
Package	Is installed by the deb, rpm, or apk package that owns the file it was found in.
Vendored	Is distributed as part of a software package with or without modifications but originates from a different project or package.
Unspecified	Its linkage could not be determined fully.

Detection

Vulnerability Database

Findings

Risk Assessment

Analysis Engine

Compliance