Vulnerable dependency may be reachable in app code
Investigates whether a vulnerable dependency version is actually used through the affected API, helper, or configuration.
| Detail | Value |
|---|---|
| Check ID | DEPENDENCY_REACHABILITY |
| Severity | Medium |
| How it runs | Agent review |
Anchor to How to fixHow to fix
Upgrade the dependency or remove the reachable vulnerable code path.
Don’t
- Keep a dependency on a version with a known vulnerability.
- Suppress an advisory in your audit configuration to get a clean scan instead of upgrading.
- Assume a vulnerable package is safe because you don't call it directly. Your other dependencies might.
Do
- Use Dependabot or Renovate to open version-bump pull requests automatically, and merge them promptly.
- Run a dependency scanner, such as
npm auditor Dependabot alerts, so that you hear about new advisories. - Commit your lockfile, so the versions you test are the versions you ship.
shopify app security check, the command that runs this check- All app security checks
Was this page helpful?