Original announcement: GitHub · 2026-11-10. Read the official announcement.
Summary of Changes
On December 8, 2026, GitHub announced that it will pause Dependabot alerts on most repositories that have shown no activity for one year. Rather than deleting existing alerts, the alerts will be archived, with the option to restore them at any time. This update aims to optimize performance and reliability by focusing Dependabot alerts on active projects amid increasing vulnerability detection volumes.
What Counts as Repository Activity?
GitHub defines repository activity as any of the following:
- Pushing to any branch or tag
- Creating the repository
- Turning on Dependabot alerts
- Manually turning alerts back on
Notably, any push to the repository automatically reactivates Dependabot alerts, restoring archived alerts and resetting the inactivity clock.
Exceptions and Special Cases
Alerts will not be turned off for repositories meeting these conditions:
- Repositories with enforced security configurations that enable Dependabot alerts
- Repositories in enterprises where a policy restricts repository admins from enabling or disabling Dependabot alerts
This policy applies to all GitHub plans on github.com and GitHub Enterprise Cloud with data residency features but does not apply to GitHub Enterprise Server customers. Archived alerts for data residency customers will be stored within the same regional data center as the rest of the enterprise’s data.
Who Should Care and What to Do Next?
Developers, security teams, and repository administrators managing projects on GitHub should review their repositories’ activity and alert settings. Inactive repositories that still require ongoing security monitoring might lose alerts unless reactivated.
To ensure continuous Dependabot monitoring:
- Periodically push or update branches to maintain repository activity
- Manually turn on Dependabot alerts in repository settings if previously disabled
- Review enterprise policies affecting Dependabot alert controls
This update helps maintain efficient alerting performance by focusing resources on actively maintained projects, improving vulnerability management at scale.
Practical Checklist
- Identify repositories inactive for over a year.
- Decide if alerts should remain active; if yes, perform a push or turn alerts back on.
- For managed enterprises, verify policies governing Dependabot alert management.
- Communicate these changes to your security and development teams.
