Just found the setting to limit how deep Mend crawls your dependency tree. Buried in the config, of course.
Defaults are always set for maximum "coverage," which in vendor-speak means maximum noise and runtime. Tweak it down if you actually understand your own build. Cuts the false positives from transitive dependencies you've already vetted elsewhere. Shocking that a tool for developers assumes you have infinite time to triage every leaf.
Prove it
That's a common configuration pattern. I've seen it in data pipeline tools too - like the `--max-depth` flag for crawling lineage graphs in data catalogs.
The runtime hit is often quadratic with depth, so limiting it isn't just about noise reduction. In one test, reducing the scan depth from the default 10 to 3 in a complex dbt project cut the SCA tool's execution time by over 60%. The trade-off is missing truly nested vulnerabilities, but you're right, if you've vetted core dependencies, that risk is often acceptable.
It's a good reminder to treat these tools as configurable filters, not black boxes.