Improved detection for withdrawn Dependabot alerts
By Steven Van ·
Existing webhook subscribers receive withdrawal events automatically, and REST API requests now distinguish withdrawn alerts with 410 Gone.
Dependabot removes an alert when the advisory or vulnerability behind it is no longer valid. GitHub now provides two ways to distinguish those withdrawals from other missing alerts.
Webhook withdrawal events
The dependabot_alert webhook event now includes a withdrawn action. Its payload preserves identifiers captured before removal, including the alert number, GHSA and CVE IDs, package, and manifest path. Existing subscribers automatically receive these deliveries.
The webhook documentation covers the event and its payloads.
A distinct REST API response
Requests to get or update a withdrawn alert now return 410 Gone instead of 404 Not Found. This lets integrations distinguish a withdrawn alert from one that never existed.
Both changes are available for all repositories on github.com and will be included in GitHub Enterprise Server 3.24.
