{"version":"1.0","generated_at":"2026-10-21T14:50:28.313606","id":3529,"slug":"dependabot-alerts-rest-api-now-includes-dependency-versions","title":"Dependabot 警报 REST API 现已包含依赖项版本","summary":"GitHub 的 Dependabot 警报 REST API 响应新增 version_requirement 字段，直接给出 Dependabot 上次记录的依赖版本或版本约束，覆盖单个警报、仓库/组织/企业列表与 webhook。该字段可减少安全工具同步时解析 lockfile 或额外发起 GraphQL 请求，但可能为 null、多版本仅记录一个值，长版本约束也可能被截断。","abstract":"Dependabot 警报 REST API 现已包含依赖项版本 GitHub 的 Dependabot 警报 REST API 响应新增 version_requirement 字段，直接给出 Dependabot 上次记录的依赖版本或版本约束，覆盖单个警报、仓库/组织/企业列表与 webhook。该字段可减少安全工具同步时解析 lockfile 或额外发起 GraphQL 请求，但可能为 null、多版本仅记录一个值，长版本约束也可能被截断。 GitHub 的 Dependabot 警报 REST API 响应新增 version_requirement 字段，直接给出 Dependabot 上次记录的依赖版本或版本约束，覆盖单个警报、仓库/组织/企业列表与 webhook。该字段可减少安全工具同步时解析 lockfile 或额外发起 GraphQL 请求，但可能为 null、多版本仅记录一个值，长版本约束也可能被截断。 原贴提到：You can now get the version of a vulnerable dependency directly from Dep 来源：github.blog 你现在可以直接在 REST API 的 Dependabot 警报响应中获取易受攻击依赖项的版本。 每个警报的 dependency 对象包含一个新的 version_requirement 字段，其中带有 Dependabot 上次为该警报记录的版本或版本约束。 警报响应此前已包含公告的易受攻击版本范围，但不包含你仓库中的版本。 如果你将警报同步到其他安全工具，则不再需…","access_level":"member","access_label":"免费阅读","access_mode":"full","is_preview":false,"canonical_url":"https://opc.beizhux.com/content/3529/dependabot-alerts-rest-api-now-includes-dependency-versions","html_url":"https://opc.beizhux.com/content/3529/dependabot-alerts-rest-api-now-includes-dependency-versions","json_url":"https://opc.beizhux.com/content/3529/dependabot-alerts-rest-api-now-includes-dependency-versions.json","published_at":"2026-10-21T01:13:40","updated_at":"2026-10-21T14:07:31","category":{"slug":"ai-business","name":"AI小生意项目库"},"source":{"site":"github.blog","author":"Allison","url":"https://github.blog/changelog/2026-10-20-dependabot-alerts-rest-api-now-includes-dependency-versions"},"tags":["Dependabot","DevSecOps","GitHub","REST API","供应链安全","依赖安全","开发者工具"],"topics":[{"slug":"ai-side-business","name":"AI副业","url":"https://opc.beizhux.com/topics/ai-side-business","reason":"这篇内容命中「项目、小生意、变现」等主题信号。"},{"slug":"ai-tools","name":"AI工具","url":"https://opc.beizhux.com/topics/ai-tools","reason":"这篇内容命中「工具」等主题信号。"}],"keywords":["AI小生意项目库","AI副业","AI工具","工具","自动化","模型","Cursor","Claude","工作流","副业","创业","项目"],"questions":[{"question":"Dependabot 警报 REST API 现已包含依赖项版本主要讲什么？","answer":"GitHub 的 Dependabot 警报 REST API 响应新增 version_requirement 字段，直接给出 Dependabot 上次记录的依赖版本或版本约束，覆盖单个警报、仓库/组织/企业列表与 webhook。该字段可减少安全工具同步时解析 lockfile 或额外发起 GraphQL 请求，但可能为 null、多版本仅记录一个值…"},{"question":"这篇文章最值得关注的要点是什么？","answer":"GitHub 的 Dependabot 警报 REST API 响应新增 version_requirement 字段，直接给出 Dependabot 上次记录的依赖版本或版本约束，覆盖单个警报、仓库/组织/企业列表与 webhook。该…；原贴提到：You can now get the version of a vulnerable dependency directly from Dep；来源：github.blog"},{"question":"这篇文章和哪些AI专题相关？","answer":"它适合放在AI副业、AI工具专题里阅读。 关联原因：这篇内容命中「项目、小生意、变现」等主题信号。；这篇内容命中「工具」等主题信号。"},{"question":"阅读这篇文章建议先理解哪些关键词？","answer":"建议先理解AI工具、工具、自动化、模型、Cursor这些关键词，再结合正文判断工具、机会或风险是否值得进入自己的工作流。"}],"terms":[{"slug":"ai-tools-term","name":"AI工具","definition":"在AI觉醒星球里，「AI工具」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/ai-tools-term","path":"/glossary/ai-tools-term","json_url":"https://opc.beizhux.com/glossary/ai-tools-term.json"},{"slug":"tools","name":"工具","definition":"在AI觉醒星球里，「工具」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/tools","path":"/glossary/tools","json_url":"https://opc.beizhux.com/glossary/tools.json"},{"slug":"automation","name":"自动化","definition":"在AI觉醒星球里，「自动化」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/automation","path":"/glossary/automation","json_url":"https://opc.beizhux.com/glossary/automation.json"},{"slug":"ai-model","name":"模型","definition":"在AI觉醒星球里，「模型」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/ai-model","path":"/glossary/ai-model","json_url":"https://opc.beizhux.com/glossary/ai-model.json"},{"slug":"cursor","name":"Cursor","definition":"在AI觉醒星球里，「Cursor」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/cursor","path":"/glossary/cursor","json_url":"https://opc.beizhux.com/glossary/cursor.json"},{"slug":"claude","name":"Claude","definition":"在AI觉醒星球里，「Claude」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/claude","path":"/glossary/claude","json_url":"https://opc.beizhux.com/glossary/claude.json"},{"slug":"workflow","name":"工作流","definition":"在AI觉醒星球里，「工作流」属于「Agent工作流」方向。聚合Agent、AI编程、Claude Code、Cursor、工作流自动化等内容，帮助你把智能体能力落到真实任务链路。 把智能体当成任务系统，而不是聊天窗口。","topic_slug":"agent-workflow","topic_name":"Agent工作流","topic_title":"Agent工作流：智能体、AI编程与自动化协作","topic_url":"https://opc.beizhux.com/topics/agent-workflow","topic_path":"/topics/agent-workflow","url":"https://opc.beizhux.com/glossary/workflow","path":"/glossary/workflow","json_url":"https://opc.beizhux.com/glossary/workflow.json"},{"slug":"side-business","name":"副业","definition":"在AI觉醒星球里，「副业」属于「AI副业」方向。筛选AI副业、AI小生意、项目认知和可收费交付案例，关注普通人可以验证、复制和沉淀的方法。 从真实痛点出发，先做能收费的小验证。","topic_slug":"ai-side-business","topic_name":"AI副业","topic_title":"AI副业：小生意、项目机会与可收费交付","topic_url":"https://opc.beizhux.com/topics/ai-side-business","topic_path":"/topics/ai-side-business","url":"https://opc.beizhux.com/glossary/side-business","path":"/glossary/side-business","json_url":"https://opc.beizhux.com/glossary/side-business.json"}],"preview_hidden_sections":[],"related_items":[{"id":3521,"title":"Anthropic 云合作生变：AWS、Google、微软视其为竞争者","url":"https://opc.beizhux.com/content/3521/anthropic-aws-google","summary":"据泄露给《华尔街日报》的 S-1 文件，Anthropic 难以从 AWS、Google 和 Microsoft 获得足够云算力，这三家厂商正日益把它当作竞争者而非客户。","access_level":"member"},{"id":3522,"title":"SpaceX 财报显示 AI 业务超预期，占收入 52%","url":"https://opc.beizhux.com/content/3522/spacex-ai-52","summary":"SpaceX 第三季度监管文件披露营收 146 亿美元、净利润 44 亿美元，扭亏为盈；更名后的「Super Intelligence」业务线表现超投资者预期，AI 已占公司收入 52%，算力规模 1.7 GW。","access_level":"member"},{"id":3523,"title":"ElevenLabs 发布两款面向实时 AI 对话的语音到语音模型","url":"https://opc.beizhux.com/content/3523/elevenlabs-releases-two-new-speech-to-speech-models-designed-for-real-time-ai-conversations","summary":"ElevenLabs 推出 Eleven Realtime 的 v1 Max 与 v1 Mini：Max 主打高准确率与 0.57 秒响应，Mini 主打低成本自然对话和轮次判断；两者通过 ElevenAgents 平台及兼容 OpenAI 的 Realtime API 提供，按分钟加 token 计费。","access_level":"member"}],"usage_policy":{"summarizable":true,"preferred_url":"https://opc.beizhux.com/content/3529/dependabot-alerts-rest-api-now-includes-dependency-versions","private_fields_excluded":true}}