Configuring reachability analysis for Dependabot alerts

Enable reachability analysis to prioritize alerts based on whether your application can call vulnerable functions in its dependencies.

Who can use this feature?

Repository administrators, organization owners, security managers, and enterprise owners can enable or disable reachability analysis for Dependabot alerts

Reachability analysis is available for public, private, and internal repositories on GitHub Enterprise Cloud, including enterprises with data residency. A GitHub Code Security license is not required.

In this article

Note

Reachability analysis for Dependabot alerts is in public preview and subject to change.

Reachability analysis helps prioritize Dependabot alerts by identifying whether your application can reach vulnerable dependency code. See About reachability analysis for Dependabot alerts.

Enabling or disabling reachability analysis for your repository

Dependabot alerts must be enabled for reachability analysis to work.

  1. On GitHub, navigate to the main page of the repository.

  2. Under your repository name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.

    Screenshot of a repository header showing the tabs. The "Settings" tab is highlighted by a dark orange outline.

  3. In the "Security and quality" section of the sidebar, click Advanced Security.

  4. To enable reachability analysis, you first need to enable Dependabot alerts. Under "Advanced Security", to the right of Dependabot alerts, toggle the setting to On.

  5. In the "Dependabot" section, to the right of "Reachability analysis", toggle the setting On or Off.

Enabling reachability analysis for your organization or enterprise

You can enable reachability analysis for repositories in your organization or enterprise with a custom security configuration. Security configurations are collections of security settings that you can customize and apply at scale. See:

Next steps

To review alerts and prioritize fixes, see Viewing and updating Dependabot alerts.