# Dependency advisories

How the Findings list shows known problems in the packages your project uses: the package view, what reachability unknown means and how advisories close.

*Where in the portal: Security → Findings → Show → Dependency advisories*

*Last updated: 2026-10-21*

A dependency advisory is a known problem in a package your project uses. The Findings list keeps advisories apart from findings in your own code, grouped by package.

## Switch to the package view

When a project is selected, the Findings toolbar has a **Show** control with three choices:

| Choice | What the list shows |
| --- | --- |
| **Code findings** | Findings in your own code, with advisories left out. |
| **Dependency advisories** | Advisories grouped by package. |
| **Everything** | Every row in one list. |

A link from a run page that counts advisories among its findings opens **Everything**. So does choosing **Waiting for review** under **Activity** in the Filter panel, because a status proposal can sit on an advisory.

## Read the package table

With **Dependency advisories** chosen, each row is one package:

- The package name and the versions in your project.
- Its ecosystem and how many lockfiles name it.
- How many advisories apply, and the severity of the package row.
- **Reachable** or **Reachability unknown**.

Open a row to see its advisories. Each one shows the advisory id, the version, the lockfile that names it, its status and its severity. Choose an advisory and it opens like any other finding. The footer counts packages and advisories; if the list is cut short it says so, and narrowing the filters shows the rest. The **Duplicates** filter works in this view.

## When reachability is unknown

An advisory says **Reachable** when it is confirmed that your code reaches the package. When that is not known, the row and the finding's Overview say **Dependency advisory, reachability unknown**, with a second line that reads **Verified** or **No verification recorded**.

The finding page shows when it was last validated under **History**. See [Reading evidence](https://kelrova.com/docs/findings/evidence).

## How advisories close

An advisory has a status like any other finding. The same statuses apply: a later scan or a re-check that no longer finds it marks it **Fixed**, and a scan that sees it again reopens it. A member with permission to manage security findings can also mark it **Accepted risk** or **False positive**. An agent can only propose those two; a member accepts or dismisses the proposal. All of this is described in [Statuses and what changes them](https://kelrova.com/docs/findings/statuses).

## Related

- [What Kelrova finds](https://kelrova.com/docs/findings/kinds)
- [Reading evidence](https://kelrova.com/docs/findings/evidence)
- [Statuses and what changes them](https://kelrova.com/docs/findings/statuses)
- [Severities](https://kelrova.com/docs/findings/severity)