Dependabot (gh CLI)

gh api /repos/<o>/<r>/dependabot/alerts

Query the Dependabot alerts of the repository with the GitHub CLI, reviewing the dependency vulnerabilities detected by GitHub.

Run it when you want Dependabot alerts from the CLI: the GitHub API returns the repo's Dependabot alerts — the dependency vulnerabilities (with CVE, severity, and fix) that GitHub detects automatically. It's the query of the GitHub ecosystem alerts: the pipeline (or report) check with the CLI. In DevSecOps with GitHub, Dependabot is the integrated SCA: automatic alerts (and fix PRs with Dependabot) — the API query gives the alert status for the report or the pipeline gate.

Don't use it without Dependabot enabled: alerts require Dependabot configuration in the repo (dependency graph and alerts) — without enabling, the API returns empty. And note: the API query gives the alerts — the status (open, dismissed) and the fix (the Dependabot PR) are managed; unresolved alerts are the pending work. The GitHub API requires the token (gh auth) with repo permissions. For local pipeline analysis, use the package manager audits (020-022); Dependabot is the GitHub layer.