JavaScript and TypeScript developers on GitHub Enterprise Cloud can now try Dependabot reachability analysis in public preview. It shows whether application code has a call path to a vulnerable dependency function, providing evidence to help prioritize fixes.
CodeQL builds a call graph and adds a verdict to each alert. Potentially reachable vulnerabilities should be treated as reachable; finding no path lowers priority but does not close the alert. Results are also available through the REST API.
The feature is off by default and requires Dependabot alerts plus an npm, Yarn, or pnpm lockfile. Preview analysis is free, without an Advanced Security license or Actions-minute charges. Only GitHub-hosted runners are supported; some monorepos and multi-manifest layouts may be unsupported.
Choose a sign-in method or comment as a guest below.