GitHub’s October 20 changelog adds version_requirement to Dependabot alert responses. Previously the API provided the advisory’s affected version range, but automation often needed a second lookup to determine the actual resolved or declared dependency version in a repository.
The field is populated from a lockfile, manifest, or dependency-submission record. It can be null, and one recorded version may not cover every affected copy of a dependency. It is still a useful improvement for scripts that classify alerts and draft remediation plans.
For small Node projects with complicated dev-dependency trees, this can reduce false assumptions about which package version is installed. It does not magically produce a patched release when the upstream maintainer has not published one.
What to do: Inspect one Dependabot alert API response and consider displaying version_requirement in the next security-triage script.