# Dependabot alerts REST API now includes dependency versions

By Steven Van · 2026-10-20

Dependabot alerts now report the vulnerable version in your repository, saving API consumers a lockfile parse or a separate GraphQL request.

Dependabot alert responses in the REST API now carry the version of the vulnerable dependency. Each alert's dependency object has a new version\_requirement field holding the version or version constraint that Dependabot last recorded for the alert. Responses already included the advisory's vulnerable version range, but not the version in the repository.

Anyone who syncs alerts to other security tools no longer needs to parse lockfiles or make a separate GraphQL request for vulnerableRequirements to get that value. [GitHub](<https://creatorstoolbox.com/tools/github>) [published the change](<https://docs.github.com/rest/dependabot/alerts>) in its REST API docs for Dependabot alerts.

## What the field contains

The value depends on how Dependabot detected the dependency:

- **Lockfiles:** the resolved version.

- **Manifests without a lockfile:** the version or version constraint declared in the manifest.

- **Dependency submission API:** the resolved version submitted by the build tooling.

The field is null when no value is available. If an alert covers more than one vulnerable version of a dependency, the field holds one recorded value and may not represent all of them. Long version constraints may also be truncated.

## Where it appears

version\_requirement is in responses for individual alerts, in repository, organization and enterprise alert lists, and in dependabot\_alert webhook payloads.

## Availability

The field is available now on github.com and GitHub Enterprise Cloud with data residency. It will be included in GitHub Enterprise Server 3.24.

![GitHub](<https://github.githubassets.com/assets/GitHub-Mark-ea2971cee799.png>)

GitHub

Where the world builds software — Git hosting, pull requests, issues, Actions CI/CD, and Copilot, free for public and private repos.

[View GitHub →](<https://creatorstoolbox.com/tools/github>)

[Original source](<https://github.blog/changelog/2026-10-20-dependabot-alerts-rest-api-now-includes-dependency-versions>)

[Read Dependabot alerts REST API now includes dependency versions on Creators Toolbox](<https://creatorstoolbox.com/blog/github-dependabot-alerts-rest-api-now-includes-dependency-versions>)

---
Canonical source: https://creatorstoolbox.com/blog/github-dependabot-alerts-rest-api-now-includes-dependency-versions