GitHub security alerts now show which version of a package you use

GitHub's security alerts can now tell you which version of a risky software component your project actually uses. The change is in Dependabot, GitHub's tool that flags code libraries with known security problems. It shows up when other programs pull alert data through GitHub's REST API, a standard way for software to request information.

What changed

Each alert's dependency entry now has a field called version_requirement. It holds the version, or version limit, that Dependabot last recorded for that alert. Before, alerts listed the advisory's vulnerable version range, but not the version in the repository itself.

Teams that copy alerts into other security tools had to work around that gap. They had to read lockfiles, which are files that list exact versions, or send a separate GraphQL request. GitHub says that is no longer needed. The field appears in single alerts, in repository, organization and enterprise lists, and in dependabot_alert webhook messages, which are automatic notices sent when an alert changes.

Limits and availability

• The field is null, meaning empty, when no value is available.
• If an alert covers several vulnerable versions, it holds only one recorded value.
• Long version constraints may be cut short.

The field is live on github.com and GitHub Enterprise Cloud with data residency. It will be included in GitHub Enterprise Server 3.24. The announcement gives no date for that release and does not mention any cost. It also says the value depends on how Dependabot detected the dependency, but the details were not included in the material.

Who it affects

This is mainly for developers and security teams that connect GitHub alerts to other tools. For them, the setup should have fewer parts that can break.