You can now get the version of a vulnerable dependency directly from Dependabot alert responses in the REST API. Each alert’s dependency object includes a new version_requirement field with the version or version constraint that Dependabot last recorded for the alert.

Alert responses already included the advisory’s vulnerable version range, but not the version in your repository. If you sync alerts to other security tools, you no longer need to parse lockfiles or make a separate GraphQL request for vulnerableRequirements to get that version.

The value depends on how Dependabot detected the dependency:

  • Lockfiles: The resolved version.
  • Manifests without a lockfile: The version or version constraint declared in the manifest.
  • Dependency submission API: The resolved version submitted by your build tooling.

The field is null when no value is available. If an alert covers more than one vulnerable version of a dependency, the field holds one recorded value and may not represent all of them. Long version constraints may also be truncated.

You’ll find version_requirement in responses for individual alerts, in repository, organization, and enterprise alert lists, and in dependabot_alert webhook payloads.

This field is available now on github.com and GitHub Enterprise Cloud with data residency, and will be included in GitHub Enterprise Server 3.24.

Learn more about the REST API endpoints for Dependabot alerts and the dependabot_alert webhook event.