Summary
On October 13, 2026, GitHub made withdrawn Dependabot alerts easier to detect: the dependabot_alert webhook gained a 'withdrawn' action carrying full alert identifiers, and the REST API now returns 410 Gone instead of 404 for withdrawn alerts.
What changed
The dependabot_alert webhook event added a 'withdrawn' action whose payload includes the alert number, GHSA and CVE IDs, package, and manifest path captured before removal; and get or update requests for a withdrawn alert now return 410 Gone instead of 404 Not Found. The change applies to all github.com repositories and ships in GitHub Enterprise Server 3.24.
Why it matters
Distinguishing a withdrawn advisory from a missing alert lets security automation and software-composition-analysis tools react correctly when GitHub retracts a false-positive advisory, avoiding stale findings and wasted remediation.
Evidence excerpt
Requests to get or update a withdrawn alert now return 410 Gone instead of 404 Not Found.