Improved detection for withdrawn Dependabot alerts

You can now more easily detect withdrawn Dependabot alerts. Dependabot withdraws and removes an alert when the advisory or vulnerability that produced it is no longer valid. Two changes help you detect these withdrawals:

• Webhooks: The dependabot_alert webhook event now includes a withdrawn action. The payload contains identifiers captured before the alert was removed, such as the alert number, GHSA and CVE IDs, package, and manifest path. If you already subscribe to dependabot_alert events, you’ll automatically receive these deliveries.
• REST API: Requests to get or update a withdrawn alert now return 410 Gone instead of 404 Not Found, so you can tell a withdrawn alert apart from one that never existed.

These changes are available for all repositories on github.com and will be included in GitHub Enterprise Server 3.24.

Learn more about the dependabot_alert webhook event and the REST API endpoints for Dependabot alerts.