Prioritize Dependabot alerts with reachability analysis

Dependabot can now check whether your code can call a vulnerable function in a dependency. Reachability analysis is in public preview for JavaScript and TypeScript, with verdicts and call-path evidence shown on GitHub's existing alert pages.

Alerts can be reachable, potentially reachable, unreachable or have reachability unavailable. Treat potentially reachable alerts as reachable. An unreachable verdict isn't a guarantee of safety or a reason to dismiss an alert on its own.

The preview is free on GitHub Enterprise Cloud, including data residency, for public, private and internal repositories. It needs Dependabot alerts enabled and a supported lock file. No GitHub Code Security license is required, and scans don't use billed Actions minutes. Self-hosted runners aren't supported.

After the initial scan, results refresh every 24 hours while open alerts remain. Code pushes don't trigger scans, and on-demand scans aren't available in preview.