Dependency reachability

A dependency scan reports every advisory that touches your lock files, and most of them are not worth acting on: the vulnerable function is never called, or the advisory does not apply to the installed version. Dependency reachability keeps only the advisories that matter. It looks at the critical and high advisories with known real-world exploitation, checks that each one applies to the version you install, and then checks whether your code actually uses the vulnerable part of the library. Advisories that fail are left out of the AI report and out of Vulnerabilities.

It works on the results of Dependency Check (SCA), so it adds nothing when that scanner is off.

Before you start

Turn it on

1. 01
   Open Static Code Analysis in the sidebar
2. 02
   Find Dependency Check (SCA) under AI Featured Code Analysis

   Its switch must be on.

3. 03
   Switch on Verify findings reachability under it

   It is on by default until you change it; the form then remembers your choice for the team.

4. 04
   Set the rest of the form and click Start Analysis

   See Static Code Analysis for the other fields.

From a pipeline, the standard-ai (default) and full-ai bundles of scansuite-ci include dependency checks with reachability, and --no-ai-verification drops it. See CI/CD and automation.

What you get

The reachable advisories appear in the scan's AI report, next to the AI Native SAST findings of the same scan. Each one carries its severity, the package, the installed and fixed versions, where the dependency is declared and any exploit references; the mitigation names the version to upgrade to, and the last column holds the Reachable verdict:

zoom_inEnlarge

• Every reachable advisory has a flowchart from the application's entry point, through the place the library is imported, to the vulnerable part of the library. It is drawn inline in the HTML report.
• Exploit references are clickable links in the HTML report and one per line in the XLSX export.
• A package with a public exploit is still reported as not reachable if your code never uses it.
• An advisory judged not reachable is remembered for that revision of the repository, so a rescan of the same commit neither checks nor reports it again.

Where the results go

The dependency report is the spreadsheet in the scan's report ZIP (Download report on the scan page). Dependency Check results are not exported to DefectDojo, with or without reachability.

When it does not run

The scan still finishes and the dependency report is still produced, but no advisory is checked. When the analysis did not complete, for example without AI or with an AI service that does not answer, the log also says Dependency reachability analysis did not complete; the scanner's dependency findings are stored without reachability verification., and the dependency findings are stored on Vulnerabilities as with Verify findings reachability off. The scan log on the scan page says which case it was:

Cost

Each advisory that is checked uses AI tokens. Scans of large operating-system package sets can report hundreds of CVEs, so they take longer and cost more. What a scan spent is shown on its page and in Scan History.