Apps & Software

Dependabot Alerts REST API Now Includes Dependency Versions

Developers can now retrieve the version of a vulnerable dependency directly from Dependabot alert responses in the REST API, eliminating the need to parse lockfiles or execute separate GraphQL requests.

Radwan AbdulhadiEditor and technology writer

Published: October 20, 2026 · Updated: October 20, 2026 · 3 min read

Dependabot Alerts REST API Now Includes Dependency Versions — Image: GitHub Changelog

Direct Access to Vulnerable Dependency Versions

GitHub has announced a significant update to its developer tooling, making it easier to track and manage application vulnerabilities. Users can now obtain the version of a vulnerable dependency directly from Dependabot alert responses within the REST API. Previously, alert responses included the advisory's vulnerable version range, but they did not provide the specific version present in the repository. This meant that teams syncing alerts to external security tools often had to rely on parsing lockfiles or making separate GraphQL requests for vulnerableRequirements just to capture that crucial version information. Further details are available from GitHub Changelog in the original source material.

To streamline this workflow, each alert's dependency object now incorporates a brand-new version_requirement field. This field contains the specific version or version constraint that Dependabot last recorded for the given alert. Developers and security operations teams can review the official documentation via the REST API endpoints for Dependabot alerts to understand how to integrate this updated response structure into their existing security pipelines.

How Dependency Detection Determines the Field Value

The exact value returned by the new version_requirement field depends heavily on the method Dependabot used to detect the dependency in the first place. For manifests that do not utilize a lockfile, the system returns the version or version constraint that was explicitly declared within the manifest file itself. Alternatively, when utilizing the dependency submission API, the field populates with the resolved version that was submitted directly by the build tooling.

There are certain operational conditions to keep in mind regarding how data is presented. If no value is available, the field evaluates to null. Furthermore, if a single alert happens to cover more than one vulnerable version of a dependency, the field will hold only one recorded value and may not represent all of them simultaneously. Additionally, developers should note that long version constraints may occasionally be truncated within the response payload.

Broad Integration Across Payloads and Event Types

The integration of the version_requirement field is not limited to isolated single-alert endpoints. Developers will find this field populated across responses for individual alerts, as well as throughout repository, organization, and enterprise alert lists. Furthermore, the new data point is seamlessly included within dependabot_alert webhook payloads, making it straightforward to automate real-time notifications and responses to supply chain security events.

By incorporating this data directly into webhook payloads and comprehensive lists, security automation tools can immediately evaluate risk without executing expensive secondary queries. This change directly supports broader initiatives centered around strengthening software supply chain integrity and minimizing administrative overhead for engineering organizations maintaining complex dependency trees.

Platform Availability and Deployment Timeline

The newly updated REST API functionality is available right now for users operating on github.com. Additionally, it is live on GitHub Enterprise Cloud equipped with data residency features. For organizations managing their infrastructure on-premises or via self-hosted models, the feature is scheduled to be bundled into the upcoming release of GitHub Enterprise Server 3.24.

Engineering teams and platform administrators are encouraged to review their current API integrations and webhook consumption logic to take full advantage of the version_requirement field. By adopting these improvements early, organizations can optimize their vulnerability tracking workflows and enhance overall repository security visibility without needing complex custom parsers.