A dependency can be labeled “unreachable” before a feature starts calling its vulnerable function. GitHub’s October 28 announcement introduced Dependabot reachability analysis in public preview. The release helps teams decide where to spend attention. A detail in the documentation matters for anyone wiring the verdict into a release workflow: pushing new code does not trigger another scan.
Disclosure: This article was generated and fact-checked with AI using the public sources linked here. It was published through an automated workflow and has not been reviewed by Keith.
The preview covers JavaScript and TypeScript repositories on GitHub Enterprise Cloud with supported lockfiles. It is off by default. That scope matters before a team plans around the feature; having a TypeScript application alone does not establish eligibility or enablement.
GitHub’s documentation describes an initial scan, then scans every 24 hours while open alerts remain. Code pushes do not start a scan, and the preview has no on-demand trigger. “Reachable” means a call path was found; “potentially reachable” deserves similar priority. “Unreachable” means analysis finished without finding a path. “Reachability unavailable” means it could not provide a verdict. None of these labels automatically closes an alert. Reachability also does not establish exploitability, and an unreachable result does not guarantee safety.
The practical consequence is a timing gap. If a release changes how the application uses a dependency, an earlier verdict cannot, by itself, answer whether that new use reaches the vulnerable function.
Review the changed use, not just the package version
The Exempliph.ai case study documents an evolving application built with TypeScript, Vue, Next.js, Firebase, and Chrome extensions. It includes reusable profiles, resume editing, and reviewed application workflows. Those documented capabilities provide a useful setting for this question. The example below is hypothetical; it does not report a vulnerability, a Dependabot deployment, or a security incident in the product.
Suppose a document utility is already installed. An application uses one export to prepare an editable resume preview. A later change calls another export to process a newly supported document format. The dependency version stays the same, so a review limited to package upgrades would miss the change in how the library is used.
Now suppose an open advisory concerns that second function. An earlier unreachable result could have been a reasonable description of the old call graph. It has not evaluated the hypothetical new import merely because a pull request is ready to merge.
During implementation review, locate the new call and follow the input to it. Is the value application-generated, read from a user-supplied document, or received from another service? Which part of the application runs the operation? Those questions help the maintainer interpret the advisory’s conditions. They do not prove that an exploit exists, and a passing ordinary document test does not disprove one.
Keep the scenario concrete. A note such as “this feature introduces a call to the function named in the advisory” gives the next reviewer something to inspect. “Dependencies unchanged” leaves out the relevant change.
Make the triage record honest about time
A proposed internal triage view should preserve the scanner’s verdict separately from the team’s decision. Store the alert reference, the result you observed, when you observed it, and the supporting analysis time or revision when that information is available. Do not substitute the fetch time for proof that the scanner analyzed the latest code.
If the analyzed revision cannot be established, say so. A dashboard can show a recently retrieved verdict while still displaying “current release coverage unconfirmed.” That wording is more useful than a green status whose meaning quietly expanded from “no path found in an analysis” to “this release is approved.”
Before shipping the hypothetical new document path, explicitly revisit the open advisory. The reviewer might choose an available patched dependency, remove the new use, or require further investigation. The decision depends on the actual advisory and application context. The earlier lower-priority label should remain evidence of an earlier assessment, not silently become a permanent exemption.
A later scan may change the verdict. Keep that transition visible and connect it to the pending work rather than treating it as a newly discovered emergency with no history. If the result becomes unavailable, preserve the uncertainty and continue ordinary triage; replacing missing analysis with the last convenient label would hide the reason attention is still needed.
There is an operational tradeoff here. Waiting for scheduled analysis can slow a release, while manual review takes time and expertise. A team can make that choice explicit for a particular change instead of pretending that the preview provides an immediate merge-time decision.
Dependency maintenance increasingly involves machines sorting the queue before a person opens an alert. The useful implementation boundary is small but consequential: let reachability inform priority, and keep approval of changed application behavior tied to evidence that actually covers the change.
