Dependency Scan False Positives

Dependency and repo scanners can flag transitive or database-matched CVEs and disputed findings even after direct updates, so results include artifacts without clear direct ownership and require careful verification before remediation.