dependabot / dependabot/dependabot-core
400 Error when marking false positive with long discussion text
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [ ] I have searched the existing issues
### Package ecosystem
Docker
### Package manager version
_No response_
### Language version
_No response_
### Manifest location and content before the Dependabot update
When attempting to mark a vulnerability as a false positive, Dependabot allows us to add a discussion/explanation. However, if the discussion text is large (contains many characters or words), the request fails with a 400 Bad Request error.
There is no clear validation message in the UI to indicate the text length limit. Instead, the request simply fails, which makes it confusing for users.
Steps to Reproduce:
1. Open a Dependabot alert.
2. Select the option to mark it as a false positive.
3. Add a long discussion text (several paragraphs or a large number of characters).
4. Submit.
5. Observe the 400 response.
Environment:
• GitHub Dependabot Alerts UI
• Repo type: [Public/Private]
• Dependabot Core version: (if applicable)
### dependabot.yml content
_No response_
### Updated dependency
_No response_
### What you expected to see, versus what you actually saw
Expected Behavior:
• Either the discussion text should support larger input, OR
• There should be a clear validation error message indicating the character/word limit before submission.
Actual Behavior:
• The request fails with a 400 Bad Request.
• No meaningful error is displayed to the user.
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs
_No response_
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Research direction
Reproduce the failure in the Dependabot Alerts UI by marking an alert as a false positive and submitting several paragraphs of discussion text. Inspect the resulting 400 response and determine whether the completed work should provide a validation message or support longer text.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100