Comment by verdverm

In addition, a good dependency security scanning tool can analyze reachability to answer this question for you