Dependabot can now tell you if a vulnerability is actually reachable
GitHub traces whether your code ever calls the vulnerable function in a flagged dependency, so you can triage JavaScript and TypeScript alerts by real risk instead of CVSS score alone.
GitHub shipped reachability analysis for Dependabot alerts in public preview on 28 October. It traces call paths from your own code to the vulnerable function inside a flagged dependency, then labels each alert Reachable, Potentially Reachable, Unreachable, or Reachability Unavailable.
It currently covers JavaScript and TypeScript projects using npm, Yarn or pnpm lockfiles, against GitHub-reviewed advisories in the Advisory Database. It runs on GitHub-hosted runners only, with a three-hour analysis timeout, and can struggle with large monorepos or repos with manifests spread across multiple directories. It needs GitHub Enterprise Cloud, including the data residency option, but not a GitHub Advanced Security licence, and it’s free during the preview with no Actions billing.
Why it matters: most Dependabot backlogs are full of alerts for code paths nobody calls, and teams end up triaging by CVSS score because there’s nothing better to sort by. A reachable/unreachable verdict gives you an actual priority order, so the vulnerable dependency you can’t reach yet gets pushed behind the one you can.
The caveat: JavaScript and TypeScript only for now, Enterprise Cloud only, and GitHub-hosted runners only, so self-hosted runner setups don’t get it yet.