dependabot / dependabot/dependabot-core

400 Error when marking false positive with long discussion text

Open
#13,019 0 comments 0 reactions 0 assignees View on GitHub
T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [ ] I have searched the existing issues

### Package ecosystem

Docker

### Package manager version

_No response_

### Language version

_No response_

### Manifest location and content before the Dependabot update

When attempting to mark a vulnerability as a false positive, Dependabot allows us to add a discussion/explanation. However, if the discussion text is large (contains many characters or words), the request fails with a 400 Bad Request error.
There is no clear validation message in the UI to indicate the text length limit. Instead, the request simply fails, which makes it confusing for users.
Steps to Reproduce:
1. Open a Dependabot alert.
2. Select the option to mark it as a false positive.
3. Add a long discussion text (several paragraphs or a large number of characters).
4. Submit.
5. Observe the 400 response.
Environment:
• GitHub Dependabot Alerts UI
• Repo type: [Public/Private]
• Dependabot Core version: (if applicable)

### dependabot.yml content

_No response_

### Updated dependency

_No response_

### What you expected to see, versus what you actually saw

Expected Behavior:
• Either the discussion text should support larger input, OR
• There should be a clear validation error message indicating the character/word limit before submission.
Actual Behavior:
• The request fails with a 400 Bad Request.
• No meaningful error is displayed to the user.

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Research direction

Reproduce the failure in the Dependabot Alerts UI by marking an alert as a false positive and submitting several paragraphs of discussion text. Inspect the resulting 400 response and determine whether the completed work should provide a validation message or support longer text.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.