Typical dependency tree for an open source project Problematic open source components may be hidden deep within the dependency tree