JLJeremy Longshoreinjeremylongshore.hashnode.dev·Jul 1 · 6 min readTransitive CVE Clearance: The Dual-Layer PatternYou bump a direct dependency to pull in a patched transitive. bun audit goes green. The lockfile is committed. Two weeks later, someone does a clean install on a fresh machine, and the vulnerable tran00
