Reachability analysis for Java

DeepSource SCA now runs reachability analysis on Java projects built with Maven. Every vulnerability in the Dependencies tab is marked Reachable or Unreachable based on whether your code can actually call into the vulnerable package, so you can prioritize what's exploitable instead of triaging every advisory in your dependency tree.

For reachable vulnerabilities, DeepSource shows the call path from your code into the vulnerable dependency. The analysis covers direct and transitive dependencies, and works at the bytecode level on your compiled project. If DeepSource can't fully analyze a project, affected vulnerabilities are marked as unknown rather than unreachable.

Reachability analysis runs automatically on Maven projects with a pom.xml. Read the docs for details.