GitHub adds explicit signals for withdrawn Dependabot alerts

GitHub gave Dependabot integrations a more specific answer when an alert has been withdrawn: 410 Gone, rather than 404 Not Found. In an October 13, 2026 changelog entry, the company said the change applies to REST API requests to get or update a withdrawn alert.

Dependabot withdraws and removes an alert when the advisory or vulnerability behind it is no longer valid, GitHub says. Previously, the API response did not distinguish a withdrawn alert from one that had never existed. The new status code makes that distinction explicit.

A companion webhook change lets integrations receive notice of a withdrawal rather than discover it through an API request. The dependabot_alert event now includes a withdrawn action, with identifiers captured before the alert was removed. GitHub lists the alert number, GHSA and CVE IDs, package and manifest path among those identifiers. Existing subscribers to dependabot_alert events will receive the deliveries automatically, the company says.

GitHub said both changes were available for all repositories on github.com and would be included in GitHub Enterprise Server 3.24. The announcement did not give a release date for that server version.