It Technology · It News

Dependabot alerts REST API now includes dependency versions

GitHub has enhanced the Dependabot alerts REST API to include the specific versions of vulnerable dependencies, improving security tooling integration and accuracy.

Published 21 Oct 2026 · Updated 21 Oct 2026
Fact check: Official source last verified 2026-10-21 05:46:57. View official source.

Introduction

On October 20, 2026, GitHub announced an important update to the Dependabot alerts REST API. This update allows users to retrieve the exact version or version constraint of a vulnerable dependency directly from the API responses, enhancing the precision and ease of security vulnerability management.

What is New?

The Dependabot alerts REST API now includes a new field named version_requirement within each alert's dependency object. This field provides the version or version constraint that Dependabot last recorded for the vulnerable dependency in the repository.

Key Features

  • Version Information Included: The API responses now contain the resolved or declared version of the vulnerable dependency, eliminating the need for additional queries or parsing.
  • Multiple Contexts Supported: The version_requirement field reflects different sources depending on how Dependabot detected the dependency:
    • For lockfiles: the resolved version.
    • For manifests without lockfiles: the declared version or version constraint.
    • For dependencies submitted via API: the resolved version from build tooling.
  • Wide Availability: This field is present in individual alert responses, repository, organization, and enterprise alert lists, as well as in Dependabot alert webhook payloads.
  • Platform Support: Available now on github.com and GitHub Enterprise Cloud with data residency; planned for GitHub Enterprise Server 3.24.

Technical Explanation

Previously, the Dependabot alerts API included the advisory's vulnerable version range but did not specify the exact version used in the repository. To obtain this, users had to parse lockfiles or make separate GraphQL requests. With the new version_requirement field, this information is directly accessible, streamlining integration with other security tools.

Note that if an alert covers multiple vulnerable versions, the field holds one recorded value which may not represent all versions. Also, very long version constraints might be truncated. When no version information is available, the field is null.

Real Use Cases

  • Security Tool Integration: Tools syncing Dependabot alerts can now directly access the exact vulnerable dependency version without extra processing.
  • Automated Vulnerability Management: Automated systems can make more accurate decisions based on precise version data.
  • Developer Notifications: Developers receive clearer information about which dependency versions are affected.

Advantages

  • Reduces complexity by removing the need to parse lockfiles or make additional API calls.
  • Improves accuracy in vulnerability reporting and remediation.
  • Enhances automation capabilities for security workflows.

Limitations

  • The version_requirement may not represent all vulnerable versions if multiple are involved.
  • Long version constraints may be truncated.
  • Field can be null if version data is unavailable.

Developer Impact and Opportunities

Developers and security teams can leverage this update to build more efficient and accurate vulnerability management tools. It simplifies the process of correlating alerts with specific dependency versions, enabling better prioritization and faster remediation.

Official Documentation and Resources

FAQ

What does the new version_requirement field represent?

It represents the version or version constraint of the vulnerable dependency as last recorded by Dependabot, reflecting the actual version in the repository.

Is the version_requirement field always present?

No, it can be null if no version information is available for the dependency.

Does this update affect GitHub Enterprise Server?

Yes, the feature will be included in GitHub Enterprise Server version 3.24.

Can this field represent multiple vulnerable versions?

If an alert covers multiple versions, the field holds one recorded value and may not represent all vulnerable versions.

Official sources

Related articles