GitHub Enhances Dependabot REST API with Dependency Version Data
According to GitHub. GitHub introduces a new version_requirement field to its Dependabot alerts API to streamline vulnerability tracking.
- • The new version_requirement field provides direct access to vulnerable dependency versions.
- • Users can now avoid manual lockfile parsing or additional GraphQL requests for version data.
- • The update is currently live on GitHub.com and GitHub Enterprise Cloud platforms.
API Update Overview
GitHub has updated its Dependabot alerts REST API to include a version_requirement field. This addition allows developers to see the specific version or version constraint recorded by Dependabot for a vulnerable dependency directly within the alert response, simplifying security workflows.
Data Detection Methods
The version information is populated based on the detection method used by Dependabot, such as resolved versions from lockfiles, declared versions in manifests, or data submitted via the dependency submission API. The field may return null if no specific version data is available.
Availability and Support
This feature is available immediately for GitHub.com and GitHub Enterprise Cloud users. GitHub confirmed that the update will be included in the upcoming GitHub Enterprise Server 3.24 release, covering individual alerts, repository lists, and webhook payloads.
- 1. github.blogOpen source