Improved Detection for Withdrawn Dependabot Alerts
GitHub updated Dependabot alerts to make detection of withdrawn alerts clearer through improved webhook events and distinct REST API responses.
What changed?
GitHub has enhanced Dependabot alerts so that withdrawn alerts are now more easily detectable. The dependabot_alert webhook event now includes a withdrawn action. The webhook payload contains identifying information retained before the alert is removed, such as the alert number, GHSA and CVE IDs, package, and manifest path. Additionally, API requests to get or update a withdrawn alert now return a 410 Gone status instead of 404 Not Found. These changes are available for all repositories on github.com and will be included in GitHub Enterprise Server 3.24.
Why does it matter to an everyday developer?
The update makes it much clearer when a Dependabot alert has been withdrawn because its underlying advisory or vulnerability is no longer valid. Previously, a withdrawn alert would disappear with only a 404 error, indistinguishable from alerts that never existed. Now, developers and automation systems can specifically identify a withdrawn alert using webhook notifications or the new API response, improving auditing, issue triage, and automated workflows.
What can the developer do now?
Developers and teams should update any internal tooling or automation that processes Dependabot alert webhook events or API responses. Systems should handle the withdrawn action in webhook payloads for accurate alert tracking and should recognize the 410 Gone API response as an indicator of withdrawn alerts, rather than treating it as a missing resource. This will improve the clarity and reliability of vulnerability management workflows.
