GitHub: Update a Dependabot alert

← Dependabot operations · Get started

Operation github.dependabot_update_alert

Provider route: PATCH /repos/{owner}/{repo}/dependabot/alerts/{alert_number}. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/github with npm, or alter-sdk-github with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { GitHubIntegration } from "@alter-ai/github";

async function execute(input: Parameters<GitHubIntegration["dependabot"]["dependabotUpdateAlert"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new GitHubIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.dependabot.dependabotUpdateAlert(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_github import GitHubIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = GitHubIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.dependabot.dependabot_update_alert(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
path	object	Required within parent	Additional keys: not allowed
path.owner	string	Required within parent
path.repo	string	Required within parent
path.alert_number	integer	Required within parent	The security alert number. Read only: true
body	object	Required within parent	Additional keys: not allowed
body.agent_assignment	object	Optional	Parameters for AI agent assignment. Only used when an agent bot login is included in `assignees`. Ignored when no agent is being assigned. Additional keys: not allowed
body.agent_assignment.custom_agent	string	Optional	A custom agent identifier.
body.agent_assignment.custom_instructions	string	Optional	Custom instructions for the agent.
body.agent_assignment.model	string	Optional	The model to use for the agent.
body.assignees	array	Optional	Usernames to assign to this Dependabot Alert. Pass one or more user logins to replace the set of assignees on this alert. Send an empty array (`[]`) to clear all assignees from the alert. To assign an AI agent, include the bot login (for example, `copilot-swe-agent[bot]`).
body.assignees[]	string	Each item
body.dismissed_comment	string	Optional	An optional comment associated with dismissing the alert. Maximum length: 280
body.dismissed_reason	string	Optional	Required when `state` is `dismissed`. A reason for dismissing the alert. One of: fix_started, inaccurate, no_bandwidth, not_used, tolerable_risk
body.state	string	Optional	The state of the Dependabot alert. A `dismissed_reason` must be provided when setting the state to `dismissed`. One of: dismissed, open
body (anyOf 1)	JSON	Alternative
body (anyOf 2)	JSON	Alternative

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
$	Model	Root	Expand Get a Dependabot alert — response body

Referenced models: Get a Dependabot alert — response body

Schemas

7 more schemas are linked from the tables above, on the schema pages.

Get a Dependabot alert — response body

Field	Type	Presence	Description and constraints
$	object	Root	A Dependabot alert. Additional keys: not allowed
assignees	array	Optional	The users assigned to this alert. Read only: true
assignees[]	Model	Each item	Expand List users — response body — item
auto_dismissed_at	Model	Optional	Expand Get a Dependabot alert — response body — auto dismissed at
created_at	string	Required within parent	The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
dependency	Model	Required within parent	Expand Get a Dependabot alert — response body — dependency
dismissal_request	Model	Optional	Expand Get a Dependabot alert — response body — dismissal request
dismissed_at	Model	Required within parent	Expand Get a Dependabot alert — response body — dismissed at
dismissed_by	Model	Required within parent	Expand Get an issue — response body — user
dismissed_comment	JSON	Required within parent
dismissed_comment (anyOf 1)	string	Alternative	An optional comment associated with the alert's dismissal. Maximum length: 280
dismissed_comment (anyOf 2)	null	Alternative
dismissed_reason	JSON	Required within parent
dismissed_reason (anyOf 1)	string	Alternative	The reason that the alert was dismissed. Known values: fix_started, inaccurate, no_bandwidth, not_used, tolerable_risk
dismissed_reason (anyOf 2)	null	Alternative
fixed_at	Model	Required within parent	Expand Get a Dependabot alert — response body — fixed at
html_url	string	Required within parent	The GitHub URL of the alert resource. Format: uri Read only: true
number	Model	Required within parent	Expand Get a Dependabot alert — response body — number
reachability	Model	Optional	Expand Get a Dependabot alert — response body — reachability
security_advisory	Model	Required within parent	Expand Get a Dependabot alert — response body — security advisory
security_vulnerability	Model	Required within parent	Expand Get a Dependabot alert — response body — security vulnerability
state	string	Required within parent	The state of the Dependabot alert. Known values: auto_dismissed, dismissed, fixed, open Read only: true
updated_at	string	Required within parent	The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
url	string	Required within parent	The REST API URL of the alert resource. Format: uri Read only: true

Referenced models: Get a Dependabot alert — response body — auto dismissed at, Get a Dependabot alert — response body — dismissed at, Get a Dependabot alert — response body — fixed at, Get a Dependabot alert — response body — number, Get a Dependabot alert — response body — dismissal request, Get a Dependabot alert — response body — security advisory, Get a Dependabot alert — response body — security vulnerability, Get an issue — response body — user, List users — response body — item, Get a Dependabot alert — response body — dependency, Get a Dependabot alert — response body — reachability

Get a Dependabot alert — response body — auto dismissed at

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	string	Alternative	The time that the alert was auto-dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
$ (anyOf 2)	null	Alternative

Get a Dependabot alert — response body — dismissed at

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	string	Alternative	The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
$ (anyOf 2)	null	Alternative

Get a Dependabot alert — response body — fixed at

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	string	Alternative	The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
$ (anyOf 2)	null	Alternative

Get a Dependabot alert — response body — number

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	integer	Alternative	The security alert number. Read only: true
$ (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$

Get a Dependabot alert — response body — dismissal request

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	object	Alternative	Information about an active dismissal request for this Dependabot alert.
$ (anyOf 1).created_at	string	Optional	The date and time when the dismissal request was created. Format: date-time
$ (anyOf 1).id	JSON	Optional
$ (anyOf 1).id (anyOf 1)	integer	Alternative	The unique identifier of the dismissal request.
$ (anyOf 1).id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
$ (anyOf 1).requester	object	Optional	The user who requested the dismissal.
$ (anyOf 1).requester.id	JSON	Optional
$ (anyOf 1).requester.id (anyOf 1)	integer	Alternative	The unique identifier of the user.
$ (anyOf 1).requester.id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
$ (anyOf 1).requester.login	string	Optional	The login name of the user.
$ (anyOf 1).status	string	Optional	The current status of the dismissal request. Known values: pending, approved, rejected, cancelled
$ (anyOf 1).url	string	Optional	The API URL to get more information about this dismissal request. Format: uri
$ (anyOf 2)	null	Alternative

Get a Dependabot alert — response body — security vulnerability

Field	Type	Presence	Description and constraints
$	object	Root	Details pertaining to one vulnerable version range for the advisory. Read only: true Additional keys: not allowed
first_patched_version	JSON	Required within parent
first_patched_version (anyOf 1)	object	Alternative	Details pertaining to the package version that patches this vulnerability. Read only: true Additional keys: not allowed
first_patched_version (anyOf 1).identifier	string	Required within parent	The package version that patches this vulnerability. Read only: true
first_patched_version (anyOf 2)	null	Alternative
package	Model	Required within parent	Expand Get a Dependabot alert — response body — dependency package
severity	string	Required within parent	The severity of the vulnerability. Known values: low, medium, high, critical Read only: true
vulnerable_version_range	string	Required within parent	Conditions that identify vulnerable versions of this vulnerability's package. Read only: true

Referenced models: Get a Dependabot alert — response body — dependency package

Get an issue — response body — user

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	Model	Alternative	Expand Get an issue — response body — user A Git Hub user
$ (anyOf 2)	null	Alternative

Referenced models: Get an issue — response body — user A Git Hub user

Get a Dependabot alert — response body — dependency package

Field	Type	Presence	Description and constraints
$	object	Root	Details for the vulnerable package. Read only: true Additional keys: not allowed
ecosystem	string	Required within parent	The package's language or package management ecosystem. Read only: true
name	string	Required within parent	The unique package name within its ecosystem. Read only: true

Policy, approvals and errors

SDK function policy ID: github.dependabot_update_alert. Catalog operation: dependabot/update-alert. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Pinned headers: {"X-GitHub-Api-Version": "2026-03-10", "User-Agent": "Alter", "Accept": "application/vnd.github+json"}

Official provider source