A pull request fails. A protracted vulnerability report seems. The report could also be technically correct. It might include the best advisory IDs, affected variations, dependency paths, severity labels, and references. However the developer nonetheless has to comb by the output and reconstruct the precise engineering choice from the proof supplied.
That reconstruction is never easy. The developer has to grasp which bundle launched the problem, whether or not the susceptible dependency is direct or transitive, whether or not the repair is definitely throughout the software group’s management, and whether or not the really useful model is protected to undertake. In addition they have to find out whether or not the dependency is utilized in manufacturing or solely throughout growth, whether or not the replace may break the appliance, and whether or not the repair belongs within the present pull request or requires separate engineering work.
That uncertainty is the place safety work usually slows. The scanner has detected danger, however the developer has not been given a transparent path from detection to choice.