Get a Dependabot alert | GitHub API (unofficial showcase)

3 parameters

ownerstringrequired

The account that owns the repository; the name is not case-sensitive.

repostringrequired

The repository name without the `.git` extension; the name is not case-sensitive.

alert_numberintegerrequired

The number identifying the Dependabot alert in the repository.

5 status codes

200Returns the Dependabot alert object, including its state, vulnerable dependency details, security advisory, affected version range, and alert timestamps.

numberintegerrequired

The security alert number.

statestringrequired

The state of the Dependabot alert.

Allowed:auto_dismisseddismissedfixedopen

dependencyobjectrequired

Details for the vulnerable dependency.

security_advisoryobjectrequired

Details for the GitHub Security Advisory.

security_vulnerabilityobjectrequired

Details pertaining to one vulnerable version range for the advisory.

urlstringrequired

The REST API URL of the alert resource.

html_urlstringrequired

The GitHub URL of the alert resource.

created_atstringrequired

The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

updated_atstringrequired

The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

dismissed_atstringrequired

The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

dismissed_byobjectrequired

A GitHub user.

dismissed_reasonstringrequired

The reason that the alert was dismissed.

Allowed:fix_startedinaccurateno_bandwidthnot_usedtolerable_risk

dismissed_commentstringrequired

An optional comment associated with the alert's dismissal.

fixed_atstringrequired

The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

auto_dismissed_atstringoptional

The time that the alert was auto-dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

dismissal_requestobjectoptional

Information about an active dismissal request for this Dependabot alert.

assigneesarray<SimpleUser>optional

The users assigned to this alert.

304Returned when the alert has not changed since the version indicated by the request's conditional headers.

403Returned when you do not have permission to access the alert, including when the token lacks the required scope.

messagestringoptional

documentation_urlstringoptional

urlstringoptional

statusstringoptional

404Returned when the Dependabot alert cannot be found in the specified repository.

messagestringoptional

documentation_urlstringoptional

urlstringoptional

statusstringoptional

410Returned when the Dependabot alert is no longer available.

messagestringoptional

documentation_urlstringoptional

urlstringoptional

statusstringoptional

Error handling

A 403 is returned when the authenticated user or token does not have permission to access the alert; OAuth app tokens and personal access tokens (classic) need the security_events scope, or public_repo for public repositories only. A 404 is returned when the alert cannot be found, and a 410 is returned when the alert is gone. The alert_number path parameter must identify an alert in the specified repository.

import { Client } from "@octridev/github";

const client = new Client({
  baseUrl: "https://api.github.com",
});

const result = await client.alerts.get({
  owner: "octocat",
  repo: "hello-world",
  alertNumber: "example",
});

{
  "number": 1,
  "state": "open",
  "dependency": {
    "package": {
      "ecosystem": "pip",
      "name": "ansible"
    },
    "manifest_path": "path/to/requirements.txt",
    "scope": "runtime",
    "relationship": "direct"
  },
  "security_advisory": {
    "ghsa_id": "GHSA-8f4m-hccc-8qph",
    "cve_id": "CVE-2021-20191",
    "summary": "Insertion of Sensitive Information into Log File in ansible",
    "description": "A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality.",
    "vulnerabilities": [
      {
        "package": {
          "ecosystem": "pip",
          "name": "ansible"
        },
        "severity": "medium",
        "vulnerable_version_range": ">= 2.9.0, < 2.9.18",
        "first_patched_version": {
          "identifier": "2.9.18"
        }
      },
      {
        "package": {
          "ecosystem": "pip",
          "name": "ansible"
        },
        "severity": "medium",
        "vulnerable_version_range": "< 2.8.19",
        "first_patched_version": {
          "identifier": "2.8.19"
        }
      },
      {
        "package": {
          "ecosystem": "pip",
          "name": "ansible"
        },
        "severity": "medium",
        "vulnerable_version_range": ">= 2.10.0, < 2.10.7",
        "first_patched_version": {
          "identifier": "2.10.7"
        }
      }
    ],
    "severity": "medium",
    "cvss": {
      "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "score": 5.5
    },
    "cvss_severities": {
      "cvss_v3": {
        "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
        "score": 5.5
      },
      "cvss_v4": {
        "vector_string": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
        "score": 8.5
      }
    },
    "epss": {
      "percentage": 0.00045,
      "percentile": "0.16001e0"
    },
    "cwes": [
      {
        "cwe_id": "CWE-532",
        "name": "Insertion of Sensitive Information into Log File"
      }
    ],
    "identifiers": [
      {
        "type": "GHSA",
        "value": "GHSA-8f4m-hccc-8qph"
      },
      {
        "type": "CVE",
        "value": "CVE-2021-20191"
      }
    ],
    "references": [
      {
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20191"
      },
      {
        "url": "https://access.redhat.com/security/cve/cve-2021-20191"
      },
      {
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1916813"
      }
    ],
    "published_at": "2021-06-01T17:38:00Z",
    "updated_at": "2021-08-12T23:06:00Z",
    "withdrawn_at": null
  },
  "security_vulnerability": {
    "package": {
      "ecosystem": "pip",
      "name": "ansible"
    },
    "severity": "medium",
    "vulnerable_version_range": "< 2.8.19",
    "first_patched_version": {
      "identifier": "2.8.19"
    }
  },
  "url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/1",
  "html_url": "https://github.com/octocat/hello-world/security/dependabot/1",
  "created_at": "2022-06-14T15:21:52Z",
  "updated_at": "2022-06-14T15:21:52Z",
  "dismissed_at": null,
  "dismissed_by": null,
  "dismissed_reason": null,
  "dismissed_comment": null,
  "fixed_at": null,
  "assignees": [
    {
      "login": "octocat",
      "id": 1,
      "node_id": "MDQ6VXNlcjE=",
      "avatar_url": "https://github.com/images/error/octocat_happy.gif",
      "gravatar_id": "",
      "url": "https://api.github.com/users/octocat",
      "html_url": "https://github.com/octocat",
      "followers_url": "https://api.github.com/users/octocat/followers",
      "following_url": "https://api.github.com/users/octocat/following{/other_user}",
      "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
      "organizations_url": "https://api.github.com/users/octocat/orgs",
      "repos_url": "https://api.github.com/users/octocat/repos",
      "events_url": "https://api.github.com/users/octocat/events{/privacy}",
      "received_events_url": "https://api.github.com/users/octocat/received_events",
      "type": "User",
      "site_admin": false
    }
  ]
}

Request

Response

Errors