Dependabot will pause alerts in inactive repositories

**+++++**::. ......... ..::**++++++**:.. *+++++++*::.. ........ ..:**++++++**::... *+++++++*::... .......... ..:**+++++**:::... **+++++**::........::::::.. .::*******:::.... ***++***:::.....:::*****::.. ..::***::::.....: :*****:::.....:::********:.. ..::::::........: ::::::........::**+++++**:.. ......... ..: ....... ...::*+++++++*::.. ........ .. .... ..::*+++++++*::.. .......... .. ... .::**+++++**::........::::::.. . .. ..:***++***:::.....:::*****::. . .. ..::*****:::.....:::********:.. . :. ...::::::........::**+++++**:.. .. :. ....:..... ...::*+++++++*::.. ... :.. ........ ..::*+++++++*::.. ..... :... ......... .::**+++++**::........::::: ::.........::::... ..:***++***:::.....:::****: ::......::::*:::.. ..::*****:::.....:::******* .....:::*******:.. ...::::::........::**+++++* ....:::**++++**::. ....:..... ...:**+++++++ ...::**++++++**:.. ........ ..:**+++++++ ..:**++++++**:... ......... .::**+++++* ..:**++++++**::.........::::... ..:***++*** .::**++++**:::......::::*:::.. ..::*****:: ..:*******:::....:::*******:.. ...:::::::. ..::::::::......:::**++++**::. ....::.... ...::::.........::**++++++**:.. ........ ......... ..::**++++++**:.. ......... ........ ..:**++++++**::.........::::... ...::.... .::**++++**:::......::::::::.. ::::::.. .::*******:::....:::*******:.. *****::.. ..::::::::......:::**++++**::. *++***:.. ...::::.........::**++++++**:.. ++++**::. ......... ..::**++++++**:.. +++++*::.. ........ ..:**++++++**::... .. +++++*::... ....::.... ..:***++++**::....... ++++**::.......:::::::.. .::*******:::....::: *****:::....::::*****::.. ..:::*::::......:::* **::::.....:::***++***:.. ...::::.........::** :::........::**+++++**::. ......... ..::** ... ..:**+++++++*::.. ........ ..:** . ..::*++++++**::... .....:.... ..:** .::**+++++**::.......:::::::.. .::* ..:********:::.....:::*****::. ..:: ..::*****:::.....:::***++***:.. ...: ...::::::........::**+++++**:.. ..... ......... ..:**+++++++*::.. ...... ........ ..::*++++++**::... ......... . ......... .::**+++++**::........::::::.. .......:::::... ..:********:::.....:::*****::. ....:::****::.. ..::*****:::.....:::***++***:. ..:::*******::. ...::::::........::**+++++**:. .::***+++++*::. .......... ...:**+++++++*:: .::**++++++**:.. ........ ..:**++++++**:: ..:**++++++**:... ........ .::**+++++**:: ..:**++++++**::........:::::... ..:********::: .::**+++***::......::::***::.. ..::*****:::.. ..:******:::.....:::*******:.. ...::::::..... ..::::::::......::***++++**::. .......... ...:::.... ...::**++++++**:.. ........ ........ ..:**++++++**:... ........ ...... ..:**++++++**::........:::::... :::... .::**+++***::......::::**:::.. :::.. ..:******:::.....:::*******:.. **::.. ..::::::::......:::**++++**::. +**:.. ...:::..... ...::**++++++**:.. +**::. ........ .::**++++++**:... . ++*::.. ........ ..:**++++++**::......... +**::... ....:::.... .::**+++***::......:::: ***::.......:::::::.. .::******:::.....:::*** **::.....:::******::.. ..::::::::......:::**++ ::......::***+++***:.. ...:::..... ...::**+++ ........::**+++++**::. ........ ..::**+++ ..:**+++++++*::.. ........ ..:**+++ ..::*++++++**::... .....::.... ..:***++ .::**++++***::.......:::::::.. .::**** ..:********::.....:::******::.. ..::::: ..:::***:::......::***+++***:.. ...:::. ...:::::.........::**+++++**::. ........ ......... ..:**+++++++*::.. ........

Which repositories are affected?

Starting December 8, 2026, GitHub will disable Dependabot alerts in most repositories with no activity during the previous year. Existing alerts will be archived rather than deleted and can be restored when alerts are re-enabled.

Pushing to any branch or tag, creating a repository, or enabling Dependabot alerts counts as activity. A new push automatically reactivates alerts; they can also be reactivated in repository settings.

Exceptions for enterprise policies

Alerts will remain enabled in repositories with a security configuration that requires Dependabot. Enterprise policies preventing repository administrators from changing the setting are also exempt.

The change applies to github.com plans and GitHub Enterprise Cloud with data residency, but not GitHub Enterprise Server. GitHub says it aims to protect alert service performance for actively developed repositories.

Which repositories are affected?

Exceptions for enterprise policies

Alerts will remain enabled in repositories with a security configuration that requires Dependabot. Enterprise policies preventing repository administrators from changing the setting are also exempt.

Which repositories are affected?

Exceptions for enterprise policies

More news

Vercel Security Review now scans GitHub repos without a linked project

The post-quantum future of web privacy

AI agents feature in Google’s 2027 security outlook

Which repositories are affected?

Exceptions for enterprise policies

More news

Vercel Security Review now scans GitHub repos without a linked project

The post-quantum future of web privacy

AI agents feature in Google’s 2027 security outlook