Every component in your inventory can show a dependency depth: direct, or some number of levels down. It's a genuinely useful signal for deciding what to look at first. It is not, and can't be, evidence that a vulnerable code path is or isn't reachable in your running product.
Where depth comes from
Depth is read straight from the dependency graph your SBOM itself describes — the
dependsOn relationships between components, walked breadth-first from your
product as the root. A component depended on directly by your product is depth 1.
A component pulled in by something at depth 1 is depth 2, and so on. Where a
component is reachable by more than one path, the shortest one wins.
That's the entire computation. Declara doesn't trace your actual call graph, doesn't run your code, and doesn't know which functions in a dependency you actually call. Depth answers "how many layers of choosing-a-dependency separate this from you," not "does your code path through the vulnerable function."
Why it's still useful
A vulnerable direct dependency is usually something your own code calls into regularly — worth assessing first. A vulnerable dependency four levels down, pulled in by something you chose for an unrelated reason, is often not something your product's behavior ever touches. Depth is the difference between assessing forty alerts as if they were equally urgent and knowing which four to look at first.
Why it's never treated as proof
"Probably not reachable" is exactly the phrase that gets misread as "not affected" — and a component several levels down can still be on a path your product exercises constantly. Depth says nothing about whether the vulnerable function is actually called, only about how many dependency choices sit between it and you. Treating a deep component as automatically safe is the mistake this page exists to head off.
A component with no depth at all — because the SBOM didn't describe a dependency graph, only a flat component list — is shown as unknown, not as depth zero. An SBOM that omits the graph hasn't told Declara "direct"; it's told Declara nothing.
Where you'll see it
Depth and its caveat appear together wherever a component or an alert is shown, so the hint travels with the warning rather than living on a separate page you might not have read. Triage still asks you to answer directly whether the vulnerable code path is reachable in your product — depth is an input to that judgment, not a substitute for it.