Easy export of Dependabot alerts

GitHub shows Dependabot alerts nicely in the browser, but there's no button to export them. I wanted a way to get all the vulnerability alerts into a file I could share with my AI agent easily.

TL;DR

• Copy the function below into your .bashrc or .zshrc file
• Restart your terminal
• cd ~/path/to/my/repo
• dependabot

Credit where it's due

I didn't come up with this. I copied this answer on Stack Overflow and extended it a little so it fetches every open alert (not just the first page), skips any you've dismissed, works out the repo for you when you're inside one, and sorts them by severity, most serious first.

What you need

• The GitHub CLI (gh), logged in with gh auth login
• jq
• Access to the repository's security alerts

The function

Paste the code below into your .bashrc, .zshrc or whatever your shell reads at startup, and you can export a repo's Dependabot alerts with one command.

dependabot() {
  local repo
  if [[ "$1" == */* && "$1" != *.json ]]; then
    repo="$1"
    shift
  else
    repo=$(gh repo view --json nameWithOwner -q .nameWithOwner 2>/dev/null)
    if [[ -z "$repo" ]]; then
      echo "usage: dependabot [owner/name] [output.json]" >&2
      echo "(owner/name is optional inside a GitHub repo folder)" >&2
      return 1
    fi
  fi

  local owner="${repo%%/*}"
  local name="${repo#*/}"
  local out="${1:-dependabot.json}"

  gh api graphql --paginate -F owner="$owner" -F name="$name" -f query='
    query($name: String!, $owner: String!, $endCursor: String) {
      repository(owner: $owner, name: $name) {
        vulnerabilityAlerts(first: 100, after: $endCursor, states: [OPEN]) {
          pageInfo { hasNextPage endCursor }
          nodes {
            createdAt
            vulnerableManifestPath
            securityVulnerability {
              severity
              package { name }
              firstPatchedVersion { identifier }
              advisory { description }
            }
          }
        }
      }
    }
  ' | jq -s '
    [.[].data.repository.vulnerabilityAlerts.nodes[]]
    | sort_by({"CRITICAL":0,"HIGH":1,"MODERATE":2,"LOW":3}[.securityVulnerability.severity])
  ' > "$out" && echo "Wrote $repo alerts to $out"
}

Reload your shell (source ~/.zshrc or open a new terminal) and you're ready to go.

Usage

Inside a GitHub repo folder, you don't need to name the repo. The function asks gh which repository you're in:

dependabot                         # current repo → dependabot.json
dependabot report.json             # current repo → report.json
dependabot owner/name              # that repo → dependabot.json
dependabot owner/name report.json  # that repo → report.json

Keep it out of Git

Because the file lands in whatever folder you run the command from, it's easy to commit by accident. In repos where I use this, I add a line to .gitignore:

dependabot.json

The JSON output is certainly not something you want sitting in a public repo, so please do be careful here.

How it works

If you don't pass an owner/name, the function runs gh repo view to find the repository for the current folder. It then calls GitHub's GraphQL API through gh api graphql, asking only for open and fixed alerts so dismissed ones are left out. The --paginate flag keeps following endCursor until every page of vulnerabilityAlerts has been fetched. Then jq -s merges the pages into one array and sorts it by severity: critical, high, moderate, low.

Each alert includes the date it was created, the manifest file it was found in, the severity, the affected package, the first version that fixes it and the advisory description.

That's it. Tiny but super useful.