[Missing API] Add dependabot_malware_alerts to security_and_analysis on PATCH /repos/{owner}/{repo}
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 45/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- openapi
- Domain
- api
Research direction
Start at the OpenAPI definition for PATCH /repos/{owner}/{repo} and inspect how the security_and_analysis fields are represented for both PATCH requests and GET responses. First verify that the GitHub API supports this field; done means the endpoint description exposes dependabot_malware_alerts consistently in both directions and the repository’s validation checks pass.
Written by the indexing model from the issue text.
Description
Missing dependabot_malware_alerts in security_and_analysis (PATCH /repos)
The security_and_analysis object on the Update a repository endpoint currently supports toggling:
dependabot_security_updatessecret_scanningsecret_scanning_push_protectionsecret_scanning_non_provider_patternssecret_scanning_validity_checks
However, Dependabot malware alerts - which is a separate toggle in the repository settings UI under Security → Advanced Security - has no corresponding field in the API.
Why this matters
I maintain tooling that manages GitHub security settings across ~80+ repositories. Everything else can be configured via the REST API, but malware alerts require either clicking through the UI for each repo or setting up an org-wide security configuration (which requires org admin).
Having a dependabot_malware_alerts field in security_and_analysis (both GET and PATCH) would make it possible to:
- Enable malware alerts in bulk across many repos
- Audit whether it's enabled as part of compliance checks
- Include it in IaC / GitOps workflows alongside the other security toggles
Expected behavior
// PATCH /repos/{owner}/{repo}
{
"security_and_analysis": {
"dependabot_malware_alerts": {
"status": "enabled"
}
}
}
And the GET response should include the current state, same as the other fields.
Current workaround
Manual toggle per repo via the UI, or org-level security configurations (requires org admin).
- Dominant language
- No language data
- Stars
- 1.6k
- Forks
- 342
- Avg merge
- 3h 33m
- Merged PRs (30d)
- 51
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/rest-api-description
-
feature
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
github/rest-api-description#7201 ·
-
feature
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/rest-api-description#7163 ·
-
feature
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
github/rest-api-description#7162 ·
-
feature
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
github/rest-api-description#7135 ·
-
feature
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
github/rest-api-description#7111 · 1 comment ·
All issues in github/rest-api-description
Similar issues
-
bug clawsweeper:linked-pr-open clawsweeper:needs-live-repro clawsweeper:no-new-fix-pr impact:message-loss issue-rating: 🐚 platinum hermit P2 regression
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
AXERA-TECH/ax-llm#77 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
games-on-whales/wolf#509 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100