Dependabot Reachability Analysis Enters Public Preview for JavaScript and TypeScript, Labeling Alerts With Four Verdicts

Overview

GitHub announced on October 28, 2026 that reachability analysis for Dependabot is in public preview for JavaScript and TypeScript. According to the GitHub changelog, the feature “looks for call paths from your code to the vulnerable functions in your dependencies and shows the evidence on each alert.”

What We Know

How the analysis works

The changelog says Dependabot runs the analysis in a managed GitHub Actions workflow, “so there’s nothing to install or maintain.” For each advisory, the analysis uses curated data that identifies the vulnerable functions in the affected package, and, per the changelog, CodeQL builds a call graph across the repository and its dependencies before searching it for a path from the code to each of those functions. GitHub Docs describes the same approach, saying the analysis uses CodeQL static analysis and curated data identifying the affected functions.

The four verdicts

Per the changelog, each open Dependabot alert gets one of four verdicts:

• Reachable: the code has at least one call path to the vulnerable function.
• Potentially reachable: the analysis could not determine whether the code calls the vulnerable function. The changelog says to treat these alerts as reachable.
• Unreachable: the analysis completed and found no call path to the vulnerable function. The changelog says these alerts are lower priority.
• Reachability unavailable: the alert could not be analyzed, and the changelog says to triage it as normal.

The changelog says verdicts appear on the existing Dependabot alerts, “they never close or dismiss an alert,” and can be filtered and sorted on the repository and organization alerts pages or read through the Dependabot alerts REST API. GitHub Docs adds that an alert can show up to five sample call paths, and that these samples are not an exhaustive list of every possible call path.

Availability and requirements

According to the changelog, the preview has these conditions:

• Cost: free. A GitHub Advanced Security license is not needed and the GitHub Actions minutes used by the analysis are not billed.
• Plans: GitHub Enterprise Cloud, including GitHub Enterprise Cloud with data residency.
• Languages: JavaScript and TypeScript with an npm, Yarn or pnpm lockfile in the repository.
• Runners: GitHub-hosted runners. Self-hosted runners are not supported during the preview.
• Advisory coverage: all GitHub-reviewed JavaScript advisories from the GitHub Advisory Database that receive Dependabot alerts.

The changelog says reachability analysis is off by default. It can be turned on for many repositories at once with a custom security configuration for an enterprise or organization, or for a single repository in the Dependabot section of Settings, and Dependabot alerts must be on to see verdicts.

Scan timing

The changelog says the first scan starts right away and “can take from a few minutes to a few hours,” and that scans then rerun daily while the repository has open Dependabot alerts. GitHub Docs states that pushing code changes does not trigger a scan, so a verdict does not reflect a code change until a later scan completes, and that scans have a three-hour time limit during the preview.

What GitHub Says About Limits

The changelog says some monorepos or repositories with manifest files in multiple directories may not be supported during the preview, and that if analysis runs longer than three hours, some results might show “Reachability unavailable”.

GitHub Docs cautions against using a verdict as a reason to close an alert. It says a verdict is a point-in-time assessment and that users should not close or dismiss an alert solely based on its reachability verdict. It also states that “A reachable function is not necessarily exploitable,” and that an Unreachable verdict is not a guarantee that a dependency is safe. A separate GitHub Docs page on Dependabot alerts recommends using reachability alongside severity, Exploit Prediction Scoring System (EPSS) scores, dependency scope and dependency relationship.

What We Don’t Know

• The sources do not say when reachability analysis will leave public preview or whether it will extend beyond GitHub Enterprise Cloud.
• The sources do not say which other languages or ecosystems will be supported.
• The sources do not give figures on how many alerts the analysis classifies as unreachable or how often scans return “Reachability unavailable.”
• All three sources are GitHub’s own pages; none is an independent evaluation of the verdicts’ accuracy.