A new look for dependency vulnerability alerts
Since Dependabot alerts launched nearly four years ago, GitHub has flagged more than 425 million potential vulnerabilities in open source dependencies. Today the company is rolling out a set of updates aimed at making those alerts easier to understand and act on.
The most visible change is in how alerts are presented. Instead of grouping alerts by package, Dependabot now shows one alert per advisory and dependency manifest. That shift lets each alert surface more granular context, including longer, more descriptive titles, a detailed breakdown of the severity score, and current information about any linked pull requests.
Search and tracking changes
Across the alert index page, there’s now a full-text search field along with a redesigned set of filter options, so it’s simpler to find a specific alert in a repository. Each alert also has its own unique numeric identifier, which will later be exposed through the GraphQL API for programmatic access and tracking.
Closed alerts stick around
The lifecycle of an alert has changed as well. Once a vulnerability is fixed, its alert is no longer deleted—it now persists and appears under a dedicated “Closed” tab in the UI. GraphQL API support for these closed alerts is expected later this month, and the ability to reopen dismissed alerts will be shipped in a follow-up release.
Organization-wide visibility for GHAS
For GitHub Advanced Security customers, the “Organization Security” tab now includes all Dependabot alerts across the organization. That consolidated view is available to organization owners and members of teams with the security manager role. Repository-level Dependabot alerts and pull requests remain free for everyone.
On the roadmap
GitHub describes these updates as a first step based on user feedback. The team says it is continuing to work on better APIs, reducing alert noise, improving actionability and configurability, and addressing other top concerns for Dependabot users. Further details will be posted on the public roadmap.
