Update a Dependabot alert

PATCH

/repos/{owner}/{repo}/dependabot/alerts/{alert_number}

The authenticated user must have access to security alerts for the repository to use this endpoint. For more information, see “Granting access to security alerts.”

OAuth app tokens and personal access tokens (classic) need the security_events scope to use this endpoint. If this endpoint is only used with public repositories, the token can use the public_repo scope instead.

API method documentation

Parameters

Path Parameters

owner

required

string

The account owner of the repository. The name is not case sensitive.

repo

required

string

The name of the repository without the .git extension. The name is not case sensitive.

alert_number

required

The security alert number.

integer

The number that identifies a Dependabot alert in its repository. You can find this at the end of the URL for a Dependabot alert within GitHub, or in number fields in the response from the GET /repos/{owner}/{repo}/dependabot/alerts operation.

Request Body^required

application/json

Any of:

object
object

object

state

required

The state of the Dependabot alert. A dismissed_reason must be provided when setting the state to dismissed.

string

Allowed values: dismissed open

dismissed_reason

Required when state is dismissed. A reason for dismissing the alert.

string

Allowed values: fix_started inaccurate no_bandwidth not_used tolerable_risk

dismissed_comment

An optional comment associated with dismissing the alert.

string

<= 280 characters

assignees

Usernames to assign to this Dependabot Alert. Pass one or more user logins to replace the set of assignees on this alert. Send an empty array ([]) to clear all assignees from the alert. To assign an AI agent, include the bot login (for example, copilot-swe-agent[bot]).

Array<string>

agent_assignment

Parameters for AI agent assignment. Only used when an agent bot login is included in assignees. Ignored when no agent is being assigned.

object

custom_instructions

Custom instructions for the agent.

string

custom_agent

A custom agent identifier.

string

model

The model to use for the agent.

string

object

state

The state of the Dependabot alert. A dismissed_reason must be provided when setting the state to dismissed.

string

Allowed values: dismissed open

dismissed_reason

Required when state is dismissed. A reason for dismissing the alert.

string

Allowed values: fix_started inaccurate no_bandwidth not_used tolerable_risk

dismissed_comment

An optional comment associated with dismissing the alert.

string

<= 280 characters

assignees

required

Array<string>

agent_assignment

Parameters for AI agent assignment. Only used when an agent bot login is included in assignees. Ignored when no agent is being assigned.

object

custom_instructions

Custom instructions for the agent.

string

custom_agent

A custom agent identifier.

string

model

The model to use for the agent.

string

Examples

default

{
  "state": "dismissed",
  "dismissed_reason": "tolerable_risk",
  "dismissed_comment": "This alert is accurate but we use a sanitizer."
}

Responses

200

Response

application/json

A Dependabot alert.

object

number

required

The security alert number.

integer

state

required

The state of the Dependabot alert.

string

Allowed values: auto_dismissed dismissed fixed open

dependency

required

Details for the vulnerable dependency.

object

package

Details for the vulnerable package.

object

ecosystem

required

The package’s language or package management ecosystem.

string

name

required

The unique package name within its ecosystem.

string

manifest_path

The full path to the dependency manifest file, relative to the root of the repository.

string

scope

The execution scope of the vulnerable dependency.

string

nullable

Allowed values: development runtime

relationship

The vulnerable dependency’s relationship to your project.

[!NOTE] We are rolling out support for dependency relationship across ecosystems. This value will be “unknown” for all dependencies in unsupported ecosystems.

string

nullable

Allowed values: unknown direct transitive inconclusive

security_advisory

required

Details for the GitHub Security Advisory.

object

ghsa_id

required

The unique GitHub Security Advisory ID assigned to the advisory.

string

cve_id

required

The unique CVE ID assigned to the advisory.

string

nullable

summary

required

A short, plain text summary of the advisory.

string

<= 1024 characters

description

required

A long-form Markdown-supported description of the advisory.

string

vulnerabilities

required

Vulnerable version range information for the advisory.

Array<object>

Details pertaining to one vulnerable version range for the advisory.

object

package

required

Details for the vulnerable package.

object

ecosystem

required

The package’s language or package management ecosystem.

string

name

required

The unique package name within its ecosystem.

string

severity

required

The severity of the vulnerability.

string

Allowed values: low medium high critical

vulnerable_version_range

required

Conditions that identify vulnerable versions of this vulnerability’s package.

string

first_patched_version

required

Details pertaining to the package version that patches this vulnerability.

object

identifier

required

The package version that patches this vulnerability.

string

severity

required

The severity of the advisory.

string

Allowed values: low medium high critical

classification

The classification of the advisory.

string

Allowed values: general malware

cvss

required

Details for the advisory pertaining to the Common Vulnerability Scoring System.

object

score

required

The overall CVSS score of the advisory.

number

<= 10

vector_string

required

The full CVSS vector string for the advisory.

string

nullable

cvss_severities

object

cvss_v3

object

vector_string

required

The CVSS 3 vector string.

string

nullable

score

required

The CVSS 3 score.

number

nullable <= 10

cvss_v4

object

vector_string

required

The CVSS 4 vector string.

string

nullable

score

required

The CVSS 4 score.

number

nullable <= 10

epss

The EPSS scores as calculated by the Exploit Prediction Scoring System.

object

percentage

number

<= 100

percentile

number

<= 100

cwes

required

Details for the advisory pertaining to Common Weakness Enumeration.

Array<object>

A CWE weakness assigned to the advisory.

object

cwe_id

required

The unique CWE ID.

string

name

required

The short, plain text name of the CWE.

string

identifiers

required

Values that identify this advisory among security information sources.

Array<object>

An advisory identifier.

object

type

required

The type of advisory identifier.

string

Allowed values: CVE GHSA

value

required

The value of the advisory identifer.

string

references

required

Links to additional advisory information.

Array<object>

A link to additional advisory information.

object

url

required

The URL of the reference.

string format: uri

published_at

required

The time that the advisory was published in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

updated_at

required

The time that the advisory was last modified in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

withdrawn_at

required

The time that the advisory was withdrawn in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

nullable

security_vulnerability

required

Details pertaining to one vulnerable version range for the advisory.

object

package

required

Details for the vulnerable package.

object

ecosystem

required

The package’s language or package management ecosystem.

string

name

required

The unique package name within its ecosystem.

string

severity

required

The severity of the vulnerability.

string

Allowed values: low medium high critical

vulnerable_version_range

required

Conditions that identify vulnerable versions of this vulnerability’s package.

string

first_patched_version

required

Details pertaining to the package version that patches this vulnerability.

object

identifier

required

The package version that patches this vulnerability.

string

url

required

The REST API URL of the alert resource.

string format: uri

html_url

required

The GitHub URL of the alert resource.

string format: uri

created_at

required

The time that the alert was created in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

updated_at

required

The time that the alert was last updated in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

dismissed_at

required

The time that the alert was dismissed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

nullable

dismissed_by

required

Simple User

A GitHub user.

object

name

string

nullable

email

string

nullable

login

required

string

required

integer format: int64

node_id

required

string

avatar_url

required

string format: uri

gravatar_id

required

string

nullable

url

required

string format: uri

html_url

required

string format: uri

followers_url

required

string format: uri

following_url

required

string

gists_url

required

string

starred_url

required

string

subscriptions_url

required

string format: uri

organizations_url

required

string format: uri

repos_url

required

string format: uri

events_url

required

string

received_events_url

required

string format: uri

type

required

string

site_admin

required

boolean

starred_at

string

user_view_type

string

dismissed_reason

required

The reason that the alert was dismissed.

string

nullable

Allowed values: fix_started inaccurate no_bandwidth not_used tolerable_risk

dismissed_comment

required

An optional comment associated with the alert’s dismissal.

string

nullable <= 280 characters

fixed_at

required

The time that the alert was no longer detected and was considered fixed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

nullable

auto_dismissed_at

The time that the alert was auto-dismissed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

nullable

dismissal_request

Dependabot alert dismissal request

Information about an active dismissal request for this Dependabot alert.

object

The unique identifier of the dismissal request.

integer

status

The current status of the dismissal request.

string

Allowed values: pending approved rejected cancelled

requester

The user who requested the dismissal.

object

The unique identifier of the user.

integer

login

The login name of the user.

string

created_at

The date and time when the dismissal request was created.

string format: date-time

url

The API URL to get more information about this dismissal request.

string format: uri

assignees

The users assigned to this alert.

Array<object>

Simple User

A GitHub user.

object

name

string

nullable

email

string

nullable

login

required

string

required

integer format: int64

node_id

required

string

avatar_url

required

string format: uri

gravatar_id

required

string

nullable

url

required

string format: uri

html_url

required

string format: uri

followers_url

required

string format: uri

following_url

required

string

gists_url

required

string

starred_url

required

string

subscriptions_url

required

string format: uri

organizations_url

required

string format: uri

repos_url

required

string format: uri

events_url

required

string

received_events_url

required

string format: uri

type

required

string

site_admin

required

boolean

starred_at

string

user_view_type

string

Examples

default

{
  "number": 2,
  "state": "dismissed",
  "dependency": {
    "package": {
      "ecosystem": "pip",
      "name": "django"
    },
    "manifest_path": "path/to/requirements.txt",
    "scope": "runtime"
  },
  "security_advisory": {
    "ghsa_id": "GHSA-rf4j-j272-fj86",
    "cve_id": "CVE-2018-6188",
    "summary": "Django allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive",
    "description": "django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.",
    "vulnerabilities": [
      {
        "package": {
          "ecosystem": "pip",
          "name": "django"
        },
        "severity": "high",
        "vulnerable_version_range": ">= 2.0.0, < 2.0.2",
        "first_patched_version": {
          "identifier": "2.0.2"
        }
      },
      {
        "package": {
          "ecosystem": "pip",
          "name": "django"
        },
        "severity": "high",
        "vulnerable_version_range": ">= 1.11.8, < 1.11.10",
        "first_patched_version": {
          "identifier": "1.11.10"
        }
      }
    ],
    "severity": "high",
    "cvss": {
      "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "score": 7.5
    },
    "cvss_severities": {
      "cvss_v3": {
        "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
        "score": 7.5
      },
      "cvss_v4": {
        "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
        "score": 8.7
      }
    },
    "cwes": [
      {
        "cwe_id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      }
    ],
    "identifiers": [
      {
        "type": "GHSA",
        "value": "GHSA-rf4j-j272-fj86"
      },
      {
        "type": "CVE",
        "value": "CVE-2018-6188"
      }
    ],
    "references": [
      {
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6188"
      },
      {
        "url": "https://github.com/advisories/GHSA-rf4j-j272-fj86"
      },
      {
        "url": "https://usn.ubuntu.com/3559-1/"
      },
      {
        "url": "https://www.djangoproject.com/weblog/2018/feb/01/security-releases/"
      },
      {
        "url": "http://www.securitytracker.com/id/1040422"
      }
    ],
    "published_at": "2018-10-03T21:13:54Z",
    "updated_at": "2022-04-26T18:35:37Z",
    "withdrawn_at": null
  },
  "security_vulnerability": {
    "package": {
      "ecosystem": "pip",
      "name": "django"
    },
    "severity": "high",
    "vulnerable_version_range": ">= 2.0.0, < 2.0.2",
    "first_patched_version": {
      "identifier": "2.0.2"
    }
  },
  "url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/2",
  "html_url": "https://github.com/octocat/hello-world/security/dependabot/2",
  "created_at": "2022-06-15T07:43:03Z",
  "updated_at": "2022-08-23T14:29:47Z",
  "dismissed_at": "2022-08-23T14:29:47Z",
  "dismissed_by": {
    "login": "octocat",
    "id": 1,
    "node_id": "MDQ6VXNlcjE=",
    "avatar_url": "https://github.com/images/error/octocat_happy.gif",
    "gravatar_id": "",
    "url": "https://api.github.com/users/octocat",
    "html_url": "https://github.com/octocat",
    "followers_url": "https://api.github.com/users/octocat/followers",
    "following_url": "https://api.github.com/users/octocat/following{/other_user}",
    "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
    "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
    "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
    "organizations_url": "https://api.github.com/users/octocat/orgs",
    "repos_url": "https://api.github.com/users/octocat/repos",
    "events_url": "https://api.github.com/users/octocat/events{/privacy}",
    "received_events_url": "https://api.github.com/users/octocat/received_events",
    "type": "User",
    "site_admin": false
  },
  "dismissed_reason": "tolerable_risk",
  "dismissed_comment": "This alert is accurate but we use a sanitizer.",
  "fixed_at": null,
  "assignees": []
}

400

Bad Request

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

Scim Error

Scim Error

object

message

string

nullable

documentation_url

string

nullable

detail

string

nullable

status

integer

scimType

string

nullable

schemas

Array<string>

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "detail": "example",
  "status": 1,
  "scimType": "example",
  "schemas": [
    "example"
  ]
}

403

Forbidden

application/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

404

Resource not found

application/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

409

Conflict

application/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

422

Validation failed, or the endpoint has been spammed.

application/json

Validation Error Simple

Validation Error Simple

object

message

required

string

documentation_url

required

string

errors

Array<string>

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "errors": [
    "example"
  ]
}

Update a Dependabot alert

Parameters

Path Parameters

Request Body required

Examples

Responses

200

Examples

400

Example generated

Example generated

403

Example generated

404

Example generated

409

Example generated

422

Example generated

Request Body^required

Example ^generated

Example ^generated

Example ^generated

Example ^generated

Example ^generated

Example ^generated