Why this small API change is useful
Security teams exporting Dependabot alerts can now retrieve a recorded dependency version directly from the REST response. GitHub’s October 20 update adds version_requirement to the dependency object, alongside the advisory information that was already available. The company also includes the field in Dependabot alert webhook payloads.
Its meaning depends on the evidence: a lockfile provides a resolved version, while a manifest without a lockfile can provide a declared constraint. GitHub says the field can be null, may represent only one of several vulnerable versions and can contain a truncated long constraint.
Release status
The field is available on github.com and GitHub Enterprise Cloud with data residency. GitHub says it will also be included in Enterprise Server 3.24. It should not be assumed present on every existing self-hosted installation.
CGH perspective
For an alert dashboard, the distinction between an installed version and a permitted range is important. A version constraint is not proof that a particular build contains a particular release. An integration should preserve that distinction and show missing information explicitly, rather than converting an empty field into a clean bill of health. A representative validation set would include a lockfile, a manifest-only project and an alert covering several versions. This change can reduce integration work without replacing dependency inventory or evidence from the build itself.