--- title: Prioritize Dependabot alerts with reachability analysis description: Dependabot alerts now get reachability verdicts in public preview for JavaScript and TypeScript. CodeQL builds a call graph across your repository and... canonical: https://daily.dev/posts/prioritize-dependabot-alerts-with-reachability-analysis-cy6sniyeb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Prioritize Dependabot alerts with reachability analysis | daily.dev og:description: Dependabot alerts now get reachability verdicts in public preview for JavaScript and TypeScript. CodeQL builds a call graph across your repository and... og:url: https://daily.dev/posts/prioritize-dependabot-alerts-with-reachability-analysis-cy6sniyeb og:image: https://api.daily.dev/og/posts/cy6SnIyeb.png og:image:alt: Prioritize Dependabot alerts with reachability analysis og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Prioritize Dependabot alerts with reachability analysis **[GitHub Changelog](https://daily.dev/sources/github_updates)** · 3 min read · 0 upvotes · 0 comments ## Summary Dependabot alerts now get reachability verdicts in public preview for JavaScript and TypeScript. CodeQL builds a call graph across your repository and dependencies to check whether your code can reach a vulnerable function. Each alert is marked reachable, potentially reachable, unreachable, or reachability unavailable. The analysis runs in a managed GitHub Actions workflow on GitHub-hosted runners, is free during preview, and requires GitHub Enterprise Cloud plus an npm, Yarn, or pnpm lockfile. It's off by default and reruns daily while the repository has open Dependabot alerts. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does the 'potentially reachable' verdict mean in GitHub Dependabot reachability analysis? It means the analysis could not determine whether the code calls the vulnerable function, and such alerts should be treated as reachable rather than deprioritized. This is one of four verdicts, alongside reachable, unreachable, and reachability unavailable, shown on Dependabot alerts to help prioritize remediation. _Teams triaging dependency alerts can track how reachability verdicts evolve by following GitHub security updates on daily.dev._ ### Does GitHub Dependabot reachability analysis support languages other than JavaScript and TypeScript? No, during the public preview it only supports JavaScript and TypeScript repositories that have an npm, Yarn, or pnpm lockfile. It runs on GitHub-hosted runners via a managed GitHub Actions workflow, and self-hosted runners aren't supported during the preview. It also requires GitHub Enterprise Cloud. _Developers deciding when to adopt reachability-based vulnerability triage can follow GitHub's rollout on daily.dev._ ### Does using Dependabot reachability analysis require a GitHub Advanced Security license? No, during the public preview it's free and doesn't require a GitHub Advanced Security license, and the GitHub Actions minutes it uses aren't billed. It's available on GitHub Enterprise Cloud plans, including GitHub Enterprise Cloud with data residency, and is off by default until enabled per repository or via an organization-wide custom security configuration. _Teams budgeting for dependency security tooling can watch for pricing changes once preview ends via daily.dev._ ## Similar posts on daily.dev - [Why Most Dependency Alerts Don’t Matter](https://daily.dev/posts/why-most-dependency-alerts-don-t-matter-kcmrv1lmm) · Kilo Blog · 0 upvotes · 0 comments - [How exposed is your code? Find out in minutes—for free](https://daily.dev/posts/how-exposed-is-your-code-find-out-in-minutes-for-free-uh0cpjdxe) · GitHub Blog · 0 upvotes · 0 comments - [AI Scan for pull requests generally available](https://daily.dev/posts/ai-scan-for-pull-requests-generally-available-bkcjbuifg) · GitHub Changelog · 0 upvotes · 0 comments - [Dependabot alerts are now assignable to AI agents for remediation](https://daily.dev/posts/dependabot-alerts-are-now-assignable-to-ai-agents-for-remediation-eb8jbmhnd) · GitHub Changelog · 0 upvotes · 0 comments - [Gain insights in your software supply chain using GitHub’s Dependency Graph](https://daily.dev/posts/gain-insights-in-your-software-supply-chain-using-github-s-dependency-graph-qj77emppa) · The Art of Simplicity · 0 upvotes · 0 comments --- Tags: [#javascript](https://daily.dev/tags/javascript), [#supply-chain](https://daily.dev/tags/supply-chain), [#codeql](https://daily.dev/tags/codeql), [#dependabot](https://daily.dev/tags/dependabot) [View this post on daily.dev](https://daily.dev/posts/prioritize-dependabot-alerts-with-reachability-analysis-cy6sniyeb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Prioritize Dependabot alerts with reachability analysis","url":"https://daily.dev/posts/prioritize-dependabot-alerts-with-reachability-analysis-cy6sniyeb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/prioritize-dependabot-alerts-with-reachability-analysis-cy6sniyeb"},"datePublished":"2026-10-28T16:16:54.252Z","dateModified":"2026-10-28T16:36:30.758Z","description":"Dependabot alerts now get reachability verdicts in public preview for JavaScript and TypeScript. CodeQL builds a call graph across your repository and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3b8336506a57f3cecbc8756d113dca4a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3b8336506a57f3cecbc8756d113dca4a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitHub Changelog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitHub Changelog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/15004b7835da4d89b02b115871f0f6dc","url":"https://daily.dev/sources/github_updates"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/prioritize-dependabot-alerts-with-reachability-analysis-cy6sniyeb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"javascript,supply-chain,codeql,dependabot","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitHub Changelog","item":"https://daily.dev/sources/github_updates"},{"@type":"ListItem","position":3,"name":"Prioritize Dependabot alerts with reachability analysis"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/prioritize-dependabot-alerts-with-reachability-analysis-cy6sniyeb#faq","mainEntity":[{"@type":"Question","name":"What does the 'potentially reachable' verdict mean in GitHub Dependabot reachability analysis?","acceptedAnswer":{"@type":"Answer","text":"It means the analysis could not determine whether the code calls the vulnerable function, and such alerts should be treated as reachable rather than deprioritized. This is one of four verdicts, alongside reachable, unreachable, and reachability unavailable, shown on Dependabot alerts to help prioritize remediation. Teams triaging dependency alerts can track how reachability verdicts evolve by following GitHub security updates on daily.dev."}},{"@type":"Question","name":"Does GitHub Dependabot reachability analysis support languages other than JavaScript and TypeScript?","acceptedAnswer":{"@type":"Answer","text":"No, during the public preview it only supports JavaScript and TypeScript repositories that have an npm, Yarn, or pnpm lockfile. It runs on GitHub-hosted runners via a managed GitHub Actions workflow, and self-hosted runners aren't supported during the preview. It also requires GitHub Enterprise Cloud. Developers deciding when to adopt reachability-based vulnerability triage can follow GitHub's rollout on daily.dev."}},{"@type":"Question","name":"Does using Dependabot reachability analysis require a GitHub Advanced Security license?","acceptedAnswer":{"@type":"Answer","text":"No, during the public preview it's free and doesn't require a GitHub Advanced Security license, and the GitHub Actions minutes it uses aren't billed. It's available on GitHub Enterprise Cloud plans, including GitHub Enterprise Cloud with data residency, and is off by default until enabled per repository or via an organization-wide custom security configuration. Teams budgeting for dependency security tooling can watch for pricing changes once preview ends via daily.dev."}}]} ```