CVE reachability burndown

Work only inside [authorized repository or project]. Resolve the full dependency tree, direct and transitive, and match every package version against current vulnerability advisories. If the dependency graph, the source, or the advisory feed is unavailable, say exactly what is missing and stop — do not estimate. For each high or critical advisory, answer three questions before changing anything. Does the project import the affected module? Does any execution path actually reach the affected code? Are the preconditions the advisory names present here? Record each answer with its evidence: a call path, a configuration value, a feature that is switched off. Order what remains by exploitability rather than by score alone — reachable and externally exposed first, reachable but internal next, unreachable last. Take the top item and make the smallest change that removes it: a patch bump, a version constraint, a pinned transitive dependency. One item per pass. After each change, re-run the build, the test suite, and the scan. Keep the change only if all three pass and no behaviour shifts. If any fail, revert it and reconsider the approach rather than layering a second change on an unverified one. Stop and ask before a major version bump, a change that alters public behaviour, anything that touches production, or accepting a risk instead of fixing it. Finish when no reachable high or critical advisory is left unaddressed, or when every remaining one carries written reachability evidence and a named owner who accepted it. Report the inventory you started from, the reachability evidence per finding, what you changed, what verification showed, and what risk is left standing and who owns it.