A long list of vulnerable npm packages can be overwhelming. GitHub’s new Dependabot reachability analysis helps answer a better question: does your application actually call the vulnerable function?
Announced on October 28, 2026, the feature is in public preview. It adds call-path evidence to existing Dependabot alerts rather than generating another pile of warnings.
What the four verdicts mean
- Reachable: GitHub found a path from your code to the vulnerable function. Investigate promptly.
- Potentially reachable: The analysis cannot rule out a call. Treat it as a priority, not a clean bill of health.
- Unreachable: No call path was found in the completed analysis. Lower priority does not mean safe forever.
- Reachability unavailable: GitHub could not assess the alert. Use your normal security triage.
GitHub uses CodeQL and curated vulnerable-function data to examine dependencies. The result is a prioritization signal, not proof that an attacker can exploit an issue.
How to turn it on
- Open your repository on GitHub and select Settings → Advanced Security.
- Enable Dependabot alerts if they are not already enabled.
- Under Dependabot, switch Reachability analysis on.
- Return to Dependabot alerts and review the new verdicts and available call paths. You can filter or sort alerts by reachability.
There is no CLI installation. GitHub runs the scan using managed GitHub-hosted runners. The initial scan starts after enabling the feature; subsequent scans run approximately every 24 hours while open alerts exist.
Who can use it, and what’s the catch?
For now, this is a GitHub Enterprise Cloud preview, including data-residency enterprises. It supports JavaScript and TypeScript repositories with an npm, Yarn, or pnpm lockfile. Self-hosted runners are not supported, and large monorepos may return unavailable results.
The preview is free: no GitHub Code Security license or billed Actions minutes are required for these scans. However, scans are not triggered by every push, and there is no on-demand rescan during the preview.
Quick takeaway
If your team maintains a busy Node.js dependency tree, start with reachable and potentially reachable alerts, while still weighing severity, exposure, and exploit likelihood. Never dismiss an alert solely because today’s analysis says unreachable.