Dependency advisories
How the Findings list shows known problems in the packages your project uses: the package view, what reachability unknown means and how advisories close.
Where in the portalSecurity → Findings → Show → Dependency advisories
Updated View as markdown
On this page
A dependency advisory is a known problem in a package your project uses. The Findings list keeps advisories apart from findings in your own code, grouped by package.
Switch to the package view
When a project is selected, the Findings toolbar has a Show control with three choices:
| Choice | What the list shows |
|---|---|
| Code findings | Findings in your own code, with advisories left out. |
| Dependency advisories | Advisories grouped by package. |
| Everything | Every row in one list. |
A link from a run page that counts advisories among its findings opens Everything. So does choosing Waiting for review under Activity in the Filter panel, because a status proposal can sit on an advisory.
Read the package table
With Dependency advisories chosen, each row is one package:
- The package name and the versions in your project.
- Its ecosystem and how many lockfiles name it.
- How many advisories apply, and the severity of the package row.
- Reachable or Reachability unknown.
Open a row to see its advisories. Each one shows the advisory id, the version, the lockfile that names it, its status and its severity. Choose an advisory and it opens like any other finding. The footer counts packages and advisories; if the list is cut short it says so, and narrowing the filters shows the rest. The Duplicates filter works in this view.
When reachability is unknown
An advisory says Reachable when it is confirmed that your code reaches the package. When that is not known, the row and the finding's Overview say Dependency advisory, reachability unknown, with a second line that reads Verified or No verification recorded.
The finding page shows when it was last validated under History. See Reading evidence.
How advisories close
An advisory has a status like any other finding. The same statuses apply: a later scan or a re-check that no longer finds it marks it Fixed, and a scan that sees it again reopens it. A member with permission to manage security findings can also mark it Accepted risk or False positive. An agent can only propose those two; a member accepts or dismisses the proposal. All of this is described in Statuses and what changes them.