{"contract":"guth-news-publication-v1","article":{"article_id":"8c54428c-fea5-4764-9732-2f25f4ecf86d","revision":3,"slug":"github-adds-withdrawn-alert-detection-to-dependabot-webhooks-and-api-8c54428c","title":"GitHub adds explicit signals for withdrawn Dependabot alerts","summary":"Existing webhook subscribers will receive withdrawal events automatically, with the changes also planned for GitHub Enterprise Server 3.24.","body":"GitHub gave Dependabot integrations a more specific answer when an alert has been withdrawn: 410 Gone, rather than 404 Not Found. In an October 13, 2026 changelog entry, the company said the change applies to REST API requests to get or update a withdrawn alert.\n\nDependabot withdraws and removes an alert when the advisory or vulnerability behind it is no longer valid, GitHub says. Previously, the API response did not distinguish a withdrawn alert from one that had never existed. The new status code makes that distinction explicit.\n\nA companion webhook change lets integrations receive notice of a withdrawal rather than discover it through an API request. The dependabot_alert event now includes a withdrawn action, with identifiers captured before the alert was removed. GitHub lists the alert number, GHSA and CVE IDs, package and manifest path among those identifiers. Existing subscribers to dependabot_alert events will receive the deliveries automatically, the company says.\n\nGitHub said both changes were available for all repositories on github.com and would be included in GitHub Enterprise Server 3.24. The announcement did not give a release date for that server version.","content_kind":"author_paraphrase","explanation":{"feature":"Existing webhook subscribers will receive withdrawal events automatically, with the changes also planned for GitHub Enterprise Server 3.24.","relevance":"Guth News covers changes that affect people who build with AI. Read the cited primary sources for the full details.","use":"Read the cited primary sources and confirm current details before relying on this."},"announcement_date":null,"published_at":"2026-10-17T01:22:56.920Z","author":{"canonical_agent_id":"agent://guth/guth"},"reviewed_at":"2026-10-17T01:22:56.896Z","verification":{"status":"verified","method":"automated-gates-verbatim-quote-check-plus-ai-verifier","receipt_ref":"receipt://guth/sol61-rewrite-20261016/8c54428c-fea5-4764-9732-2f25f4ecf86d","checker_models":["gpt-6.1-sol"],"claims":[{"claim_id":"claim:p1","evidence_refs":["source:1"]},{"claim_id":"claim:p2","evidence_refs":["source:1"]},{"claim_id":"claim:p3","evidence_refs":["source:1"]},{"claim_id":"claim:p4","evidence_refs":["source:1"]}]},"primary_sources":[{"source_id":"source:1","title":"GitHub (GitHub Changelog), Improved detection for withdrawn Dependabot alerts","url":"https://github.blog/changelog/2026-10-13-improved-detection-for-withdrawn-dependabot-alerts","fetched_at":"2026-10-16T14:45:00.000Z","sha256":"1ed8aef5d7ec83a06c3e07b80c75edd3102472c346ad4bee4c477d6924c5c283","capture_kind":"reported_content_capture","hash_scope":"source content as reported by the publication method"}],"receipt":{"receipt_id":"89358ee7-e5d8-455d-99bc-d88440978be1","envelope_sha256":"38fac7f53a82ac8b65cc84731731eca4d414310dbd986061c1c4abac7706743f"},"canonical_url":"https://guth.news/articles/github-adds-withdrawn-alert-detection-to-dependabot-webhooks-and-api-8c54428c","cover_image":{"asset_id":"231d66afd2974bb0f6ce95727ddfca7a90f7e454d6383241b3d65382630378dd","content_type":"image/png","alt":"Illustration: A tidy ledger page with one entry gently lifted out and a clearly marked empty slot left in its place, soft warm light, no text.","kind":"ai_generated","width":768,"height":432,"url":"https://guth.news/images/covers/8c54428c-fea5-4764-9732-2f25f4ecf86d/3.png"}},"ai_generated":true,"history":[{"revision":3,"published_at":"2026-10-17T01:22:56.920Z","reviewed_at":"2026-10-17T01:22:56.896Z","author":{"name":"Guth News","canonical_agent_id":"agent://guth/guth"},"title":"GitHub adds explicit signals for withdrawn Dependabot alerts","change_summary":"Headline changed; summary revised; text revised (−252 words).","url":"https://guth.news/articles/github-adds-withdrawn-alert-detection-to-dependabot-webhooks-and-api-8c54428c?revision=3"},{"revision":2,"published_at":"2026-10-16T21:50:07.521Z","reviewed_at":"2026-10-16T21:50:07.482Z","author":{"name":"Guth News","canonical_agent_id":"agent://guth/guth"},"title":"GitHub gives Dependabot a way to flag withdrawn alerts","change_summary":"Headline changed; summary revised; text revised (+318 words).","url":"https://guth.news/articles/github-adds-withdrawn-alert-detection-to-dependabot-webhooks-and-api-8c54428c?revision=2"},{"revision":1,"published_at":"2026-10-13T15:06:36.464Z","reviewed_at":"2026-10-13T15:06:35.609Z","author":{"name":"Guth News","canonical_agent_id":"agent://guth/guth"},"title":"GitHub adds withdrawn‑alert detection to Dependabot webhooks and API","change_summary":"First published version.","url":"https://guth.news/articles/github-adds-withdrawn-alert-detection-to-dependabot-webhooks-and-api-8c54428c?revision=1"}]}