It's not _my_ tests that depend on C, but B's tests. I don't maintain B, nor do I care for its tests. They shouldn't be in my dependency tree at all.

This is a problem because every time C has a vulnerability, you get a deluge of vulnerability scanner alerts or Dependabot pull requests to update it, even though your application has nothing to do with C.

If anyone has a solution for this, I'd really love to hear it because it consumes a silly amount of time to deal with bogus vulnerability alerts.