Good rundown. One thing I'd add: when the vulnerable package is three levels deep and the direct dependency hasn't shipped a patch yet, npm overrides (or pnpm overrides) lets you force the fixed transitive version without waiting on upstream. Saved me more than once. And enforcing npm ci instead of npm install in CI/deploy so the lockfile you audited is the one that actually ships — that one bites people quietly. For the transitive cases with no patch yet, do you pin-and-wait or swap the package out?