Improved detection for withdrawn Dependabot alerts
Dependabot now provides improved detection for withdrawn alerts that are no longer valid due to advisory or vulnerability changes. This makes it easier to identify and manage alerts that have been removed.
You can now more easily detect withdrawn Dependabot alerts. Dependabot withdraws and removes an alert when the advisory or vulnerability that produced it is no longer valid. Two changes help you detect these withdrawals:
- Webhooks: The
dependabot_alertwebhook event now includes awithdrawnaction. The payload contains identifiers captured before the alert was removed, such as the alert number, GHSA and CVE IDs, package, and manifest path. If you already subscribe todependabot_alertevents, you’ll automatically receive these deliveries. - REST API: Requests to get or update a withdrawn alert now return
410 Goneinstead of404 Not Found, so you can tell a withdrawn alert apart from one that never existed.
These changes are available for all repositories on github.com and will be included in GitHub Enterprise Server 3.24.
Learn more about the dependabot_alert webhook event and the REST API endpoints for Dependabot alerts.
The post Improved detection for withdrawn Dependabot alerts appeared first on The GitHub Blog.
Source: original entry ↗
More from GitHub
Follow GitHub to get its new changes in your feed and email digest.
GitHub App improvements for least privilege and management
GitHub has released improvements to GitHub Apps that enable developers to migrate away from classic personal access tokens, enhance app management capabilities, and request fewer sensitive permissions for better security.
Gemini 4 Argon now available in GitHub Copilot
Google's Gemini 4 Argon frontier model is now generally available in GitHub Copilot, designed for complex coding, agentic, and reasoning tasks to enhance developer productivity.
Audit GitHub Code Quality finding dismissals and reopenings
Users can now review manual dismissals and reopenings of GitHub Code Quality findings in their organization or enterprise audit log, enabling better tracking and governance of code quality decisions.