Dependabot alerts can add up faster than a team can work through them. A vulnerable package in your dependency tree doesn’t always mean your code uses the vulnerable part of it, so knowing whether it does gives you more context when deciding where to start.

Reachability analysis for Dependabot, now in public preview for JavaScript and TypeScript, adds that context to your alerts. It looks for call paths from your code to the vulnerable functions in your dependencies and shows the evidence on each alert. Use it alongside severity, EPSS score, production context, and your own knowledge of your application to prioritize and remediate dependency vulnerabilities in the way that works for your team.

How it works

Dependabot runs reachability analysis for you in a managed GitHub Actions workflow, so there’s nothing to install or maintain. For each advisory, the analysis uses curated data that identifies the vulnerable functions in the affected package. CodeQL builds a call graph across your repository and its dependencies, then searches it for a path from your code to each of those functions.

Each open Dependabot alert gets one of these verdicts:

Reachable: Your code has at least one call path to the vulnerable function.
Potentially reachable: The analysis couldn’t determine whether your code calls the vulnerable function. Treat these alerts as reachable.
Unreachable: The analysis completed and found no call path to the vulnerable function. These alerts are lower priority.
Reachability unavailable: The alert couldn’t be analyzed. Triage it as you normally would.

Call paths view on a Dependabot alert, tracing a call from server.js through the moment package to the vulnerable function

Verdicts appear on the Dependabot alerts you already use, and they never close or dismiss an alert. Filter and sort by verdict on the repository and organization alerts pages, or use the Dependabot alerts REST API to bring the same signal into your own tools and agents.

Dependabot alerts list filtered by reachability:reachable, showing a Reachable label next to each alert's severity

Availability and requirements

During the public preview:

Cost: Free. You don’t need a GitHub Advanced Security license and you aren’t billed for the GitHub Actions minutes the analysis uses.
Plans: GitHub Enterprise Cloud, including GitHub Enterprise Cloud with data residency.
Languages: JavaScript and TypeScript with an npm, Yarn, or pnpm lockfile in the repository.
Runners: The analysis runs on GitHub-hosted runners. Self-hosted runners aren’t supported during the preview. As with Dependabot updates, you don’t need to turn on GitHub Actions for the analysis to run.
Repository size and code complexity: Some monorepos and/or repositories with manifest files in multiple directories may not be supported during the preview. During the preview, if analysis runs for longer than three hours, some results might show “Reachability unavailable”.
Advisory coverage: All GitHub-reviewed JavaScript advisories from the GitHub Advisory Database that receive Dependabot alerts are covered.

Get started

Reachability analysis is off by default. Turn it on for many repositories at once with a custom security configuration for your enterprise or organization, or for a single repository in the Dependabot section of Settings > Advanced Security. Dependabot alerts must be on to see reachability verdicts.

The first scan starts right away and can take from a few minutes to a few hours. Scans then rerun daily while the repository has open Dependabot alerts, so verdicts keep up as your code and advisories change.

To learn more, see About reachability analysis for Dependabot alerts in GitHub Docs.

If you have questions or feedback, leave a comment in our Community discussion.

The post Prioritize Dependabot alerts with reachability analysis appeared first on The GitHub Blog.