GitHub Dependabot Alerts REST API Now Includes Dependency Versions

Disclosure: this post contains affiliate links. If you buy through them we may earn a commission at no extra cost to you. Learn more.

TL;DR: GitHub has enhanced its Dependabot alerts REST API by adding a new version_requirement field that provides the version of vulnerable dependencies directly in alert responses. This eliminates the need for developers to parse lockfiles or make separate GraphQL requests to obtain version information when syncing alerts to other security tools. The feature is available now on github.com and GitHub Enterprise Cloud, with support coming to GitHub Enterprise Server 3.24.

What's New

GitHub has released an improvement to its Dependabot alerts REST API that simplifies how developers access version information for vulnerable dependencies. The update introduces a new version_requirement field within each alert's dependency object, providing the version or version constraint that Dependabot last recorded for the alert.

Previously, alert responses included the advisory's vulnerable version range but not the specific version present in a repository. This meant developers who needed to sync alerts to other security tools had to either parse lockfiles manually or make separate GraphQL requests for vulnerableRequirements to obtain version information. With this new field, that information is now immediately available in the API response.

The version_requirement field's value varies depending on how Dependabot detected the dependency. For lockfiles, it shows the resolved version. For manifests without a lockfile, it displays the version or version constraint declared in the manifest. When dependencies are detected through the Dependency submission API, it provides the resolved version submitted by build tooling. The field returns null when no value is available.

Developers should be aware of two limitations: if an alert covers multiple vulnerable versions of a dependency, the field holds only one recorded value and may not represent all of them. Additionally, long version constraints may be truncated.

The new field appears in multiple places throughout the API: responses for individual alerts, repository alert lists, organization alert lists, enterprise alert lists, and dependabot_alert webhook payloads. This consistency ensures developers can access version information regardless of which API endpoint they're using.

Pricing and Availability

The version_requirement field is available now on github.com and GitHub Enterprise Cloud with data residency at no additional cost. Organizations using GitHub Enterprise Server will receive this feature in version 3.24. Pricing details for GitHub's various plans were not specified in the announcement.

How to Try It

Developers can start using the new field immediately by making requests to any of the Dependabot alerts REST API endpoints. The field will automatically appear in alert responses without requiring any configuration changes. For webhook integrations, the version_requirement field will now be included in dependabot_alert webhook payloads.

GitHub provides documentation for the REST API endpoints for Dependabot alerts and the dependabot_alert webhook event, which developers can consult for detailed implementation guidance.

Who It's For

This update primarily benefits security teams and developers who integrate Dependabot alerts with external security tools and vulnerability management platforms. Organizations that maintain custom security dashboards or reporting systems will find the direct access to version information particularly valuable, as it reduces the complexity of their integration code.

Development teams working across multiple repositories or those managing security at the organization or enterprise level will appreciate having version data readily available in list responses. The feature is especially useful for teams that need to prioritize remediation efforts based on specific versions of vulnerable dependencies.

Alternatives

While GitHub's Dependabot is a widely-used dependency scanning solution, developers have other options for managing security vulnerabilities in their projects. Snyk offers similar dependency scanning capabilities with its own API integrations. WhiteSource (now Mend) provides software composition analysis with vulnerability detection. OWASP Dependency-Check offers an open-source alternative for identifying known vulnerabilities in project dependencies.

For broader development workflow management that includes security considerations, platforms like ClickUp can help teams track and prioritize security issues alongside other development tasks. Additionally, Make can be used to create automated workflows that respond to security alerts and integrate with multiple security tools.