Historical Dependency Updates

Secure Dependency Updates has been replaced by Dependency Validation. Enable the new check in repository settings. Dependabot or Renovate creates the update PR; Superagent tests application exploitability on its base and verifies the proposed fix on its head.

Historical reads

GET /api/v1/dependency-updates/{runId} remains available for historical runs. Send an organization API key as a bearer token. Runs are scoped to that organization; a missing or inaccessible run returns 404.

The response retains its historical dependency_update_run shape, including status, scope, counts, timestamps, and the stored summary when available. MCP get_dependency_update(run_id) also remains available for historical reads.

Retired creation endpoint

POST /api/v1/repositories/{repositoryId}/dependency-updates returns 410 Gone. It cannot schedule work, run Dependabot, or publish update PRs. The MCP tool trigger_dependency_updates has been removed. Historical dependency_update.published events describe the retired updater and are not emitted by Dependency Validation. Its check results appear on the native update PR.