bridge triage: 'Remove unused dependency' action assumes direct dep, fires on transitive deps #47

Bug

panic-attack bridge triage emits the recommended action:

Remove unused dependency <pkg> from Cargo.toml

for any phantom-classified CVE — but in practice ALL the phantom-classified findings I sampled across the 2026-05-26 estate sweep (28/28 in a 6-repo sample, 157 phantoms total) are transitive deps pulled in by upstream crates, never declared in any Cargo.toml.

Evidence

In every case grep -E '^\s*<pkg>\s*=' Cargo.toml returns nothing — the dep is purely transitive. cargo update doesn't drop these either (they're at the latest crates.io version matching the upstream's constraint).

Fix sketch

bridge triage should:

1. Detect direct vs transitive by checking whether the package appears as a key in the project's [dependencies] / [dev-dependencies] / [build-dependencies] sections (or workspace equivalents).

2. For direct phantom deps: keep the current Remove unused dependency action.

3. For transitive phantom deps: emit a different action, something like:

   Transitive via <parent>; consider cargo update -p <parent> or bumping its constraint in Cargo.toml. If no upstream fix exists, the finding is informational only (code unreachable from this project).

4. For unmitigable + reachable: actionable warning (this is the real-risk category — 8 in the 2026-05-26 sweep, all advisory-issued without fixed versions).

Cross-references

• Estate sweep tracker: panic-attack estate sweep — 2026-05-26 #32
• Track E bridge-triage tracking issues across 24 Rust repos all reproduce the same misclassification

The underlying "informational + phantom" classification is correct (these CVEs really are unreachable). It's only the action-string that's wrong.