Content by Carlin Cherry (2)

Carlin Cherry explains how reachability analysis follows call paths to determine whether an application can invoke vulnerable dependency code flagged by Dependabot. The short introduces reachability as one signal for prioritizing vulnerabilities, alongside severity, EPSS, and production context, rather than a standalone basis for deciding what to fix.

Carlin Cherry explains why Dependabot now applies a default three-day cooldown before opening non-security version update pull requests, aiming to reduce exposure to fast-moving supply chain attacks where malicious package releases are discovered and removed within hours.