How dependency graphs work (or don't work) seemingly keeps confusing people.
Depending on ecosystem and tooling, users are sometimes led to believe that the graph is indeed a tree, which really matters when you want to give "update component A, then issues in A's transitive dependencies go away, too" advice.
You can't make this verdict from an SBOM dependency graph alone, because the SBOM consumer has no freaking idea how your package manager does version resolution.




















