Prioritize Dependabot alerts with reachability analysis
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
GitHub has launched a public preview of reachability analysis for Dependabot alerts, currently covering JavaScript and TypeScript repositories on Enterprise Cloud. It checks whether your code has a call path to the vulnerable functions in a flagged dependency, labeling each alert as reachable, potentially reachable, unreachable, or unavailable.