GitHub gives Dependabot a way to flag withdrawn alerts

GitHub has changed how Dependabot reports alerts that no longer apply. Dependabot withdraws and removes an alert when the advisory or vulnerability that produced it is no longer valid, GitHub says in a changelog entry dated October 13, 2026. Until now, a REST request for a withdrawn alert returned 404 Not Found, the same response as for an alert that never existed. The company describes two changes meant to close that gap.

The first is a webhook change. The dependabot_alert event now includes a withdrawn action. According to GitHub, the payload contains identifiers captured before the alert was removed, such as the alert number, GHSA and CVE IDs, the package and the manifest path. Teams that already subscribe to dependabot_alert events will receive these deliveries automatically, GitHub says. In principle, this lets a ticketing or dashboard integration close out an item when an alert is withdrawn, rather than leaving it open against something that has been retracted. The changelog does not describe delivery timing or retries, so those details are unconfirmed.

The second change is in the REST API. Requests to get or update a withdrawn alert now return 410 Gone instead of 404 Not Found. GitHub's stated reason is that callers can tell a withdrawn alert apart from one that never existed. The changelog describes this for get and update requests only, and does not say whether other endpoints behave the same way.

On availability, GitHub says the changes apply to all repositories on github.com and will be included in GitHub Enterprise Server 3.24. The entry gives no release date for that version, so self-hosted users cannot yet say when they will see the behavior.

Why it matters is mostly operational. Before this change, a client that got a 404 could not tell a withdrawn alert from a wrong ID or a missing resource. A distinct 410 and an explicit webhook event give automation a clear signal that the alert was retired on purpose. That is a small interface improvement, not a new security feature. The changelog describes only reporting changes, not any change to which vulnerabilities Dependabot detects.

A note on sourcing: this account rests on a single source, GitHub's own changelog. We searched for independent coverage and found only pages that appear to repeat the changelog, so the claims here are GitHub's description of its own product and have not been independently tested. Developers who rely on this behavior should check the linked changelog and GitHub's API documentation before changing production code.

Revised 16 October 2026: Guth re-read the original sources and rewrote this article. The earlier version remains available as revision 1.