Track Dependabot reachability availability on GitHub Team #805

🤖 Generated by the Agentic Engineer

Desired outcome

Use Dependabot reachability analysis to prioritize vulnerable JavaScript/TypeScript dependencies when it becomes available on GitHub Team.

Maintainer decision

Keep this on the Enterprise feature wish list. Wait for Team-plan availability; do not upgrade solely for this capability. Re-evaluate earlier only if other independently needed Enterprise features make an Enterprise subscription worthwhile. This issue does not authorize an upgrade or subscription change.

Current constraint

As verified on 2026-10-29, devantler-tech uses GitHub Team and the reachability option is absent from its security configuration. GitHub limits the public preview to Enterprise Cloud, supports npm/Yarn/pnpm lockfiles for JavaScript and TypeScript, and does not charge for analysis minutes during the preview. Existing Dependabot alerts stay enabled.

Resume conditions

• GitHub documents Team-plan availability and the setting is available for our organization; or
• The maintainer independently approves Enterprise for a broader set of required features.

Then enable it through the maintained organization security configuration for eligible repositories and verify the initial analysis. Until then this is deferred product availability, not active implementation.

Priority Low: useful prioritization context, no current outage or deadline. Effort Low for adoption after availability. Service class Standard.

Sources: https://github.blog/changelog/2026-10-28-prioritize-dependabot-alerts-with-reachability-analysis/ and https://docs.github.com/en/code-security/concepts/supply-chain-security/about-reachability-analysis-for-dependabot-alerts