---
title: Vulnerable dependency may be reachable in app code
description: >-
  Investigates whether a vulnerable dependency version is actually used through
  the affected API, helper, or configuration.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/dependency-reachability
  md: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/dependency-reachability.md
---

# Vulnerable dependency may be reachable in app code

Investigates whether a vulnerable dependency version is actually used through the affected API, helper, or configuration.

| Detail | Value |
| - | - |
| Check ID | `DEPENDENCY_REACHABILITY` |
| Severity | Medium |
| How it runs | Agent review |

***

## How to fix

Upgrade the dependency or remove the reachable vulnerable code path.

**Don’t**

* Keep a dependency on a version with a known vulnerability.
* Suppress an advisory in your audit configuration to get a clean scan instead of upgrading.
* Assume a vulnerable package is safe because you don't call it directly. Your other dependencies might.

**Do**

* Use Dependabot or Renovate to open version-bump pull requests automatically, and merge them promptly.
* Run a dependency scanner, such as `npm audit` or Dependabot alerts, so that you hear about new advisories.
* Commit your lockfile, so the versions you test are the versions you ship.

***

## Related

* [`shopify app security check`](https://shopify.dev/docs/api/shopify-cli/app/app-security-check), the command that runs this check
* [All app security checks](https://shopify.dev/docs/apps/build/security/app-security-checks)

***