A CVE just hit your base image. Your scanner won't tell you which repos to fix.

A scanner finds the vulnerable base image or package — not the repos you patch. Why CVE remediation is a cross-repo source problem, shown in Docker and npm.