GitHub Previews Dependabot Reachability Analysis for JavaScript and TypeScript Alerts

GitHub released reachability analysis for Dependabot alerts in public preview on October 28, 2026. It works for JavaScript and TypeScript, and it adds a verdict to each open alert: whether the code in a repository has a call path to the vulnerable function in a dependency. GitHub presents the verdict as extra context for ordering work, to be used alongside severity, the EPSS score, production context and the team's own knowledge. It never closes or dismisses an alert.

The mechanism has three parts. Dependabot runs the analysis for the user in a managed GitHub Actions workflow, so nothing needs to be installed or maintained. For each advisory, curated data identifies the vulnerable functions in the affected package. CodeQL then builds a call graph across the repository and its dependencies and searches it for a path from the user's code to each of those functions. The evidence appears on the alert, for example a call path that runs from a file in the repository through a package to the vulnerable function.

Each open alert receives one of four verdicts. Reachable means the code has at least one call path to the vulnerable function. Potentially reachable means the analysis could not determine whether the function is called, and GitHub says to treat these alerts as reachable. Unreachable means the analysis finished and found no call path, so the alert is lower priority, not closed. Reachability unavailable means the alert could not be analyzed, and it should be triaged as usual. The distinction between unreachable and potentially reachable matters, because only one of them is a finished negative result.

The preview has firm limits. It is free: no GitHub Advanced Security license is needed and the Actions minutes it uses are not billed. It is open to GitHub Enterprise Cloud, including data residency. It covers JavaScript and TypeScript repositories with an npm, Yarn or pnpm lockfile, and it runs only on GitHub-hosted runners, not self-hosted ones. Some monorepos, and repositories with manifest files in several directories, may not be supported. If the analysis runs longer than three hours, some results may show Reachability unavailable. Coverage includes all GitHub-reviewed JavaScript advisories from the GitHub Advisory Database that receive Dependabot alerts.

The feature is off by default. Administrators can turn it on for many repositories at once with a custom security configuration at enterprise or organization level, or for one repository in the Dependabot section of Settings, under Advanced Security. Dependabot alerts must already be on. The first scan starts at once and can take from a few minutes to a few hours, and scans then rerun daily while the repository has open Dependabot alerts. Verdicts show on the alerts pages, where they can be filtered and sorted, and the Dependabot alerts REST API carries the same signal for other tools and agents.

Reachability is a prioritization aid, not a safety proof. A call path found by static analysis shows the code can reach the function, not that an attacker can exploit it. The reverse also holds: the page gives no accuracy figures, so an Unreachable verdict is a lower-priority signal, not a guarantee. The preview excludes most plans and every language but two, so many teams will see no verdicts yet. For teams on Enterprise Cloud with JavaScript code, it offers a way to sort a long alert list with evidence attached to each entry.