GitHub said on November 10, 2026 that it will begin switching off Dependabot alerts on most repositories that have been idle for twelve months. The change starts on December 8, 2026. Alerts that already exist on those repositories are archived rather than removed, and they come back when the repository becomes active again.
The company links the move to the fast growth in newly found vulnerabilities and in the number of alerts it has to generate. By focusing the service on code that people still work on, GitHub wants Dependabot to stay quick and dependable. For teams with many old repositories, the change can quietly alter which projects still receive security warnings.
What Is Changing
From December 8, GitHub will look at each repository and check whether anything has happened in the past year. If nothing has, Dependabot alerts are turned off for it. The existing alert history is moved into an archive, so no record is lost.
This is different from deleting a feature. A paused repository can get its alerts back at any moment, and the archived alerts reappear along with them. The rule covers most repositories, but there are clear exceptions described below.
What Counts as Activity
GitHub uses a short list of events to decide whether a repository is still alive. Any one of them resets the one-year window:
- A push to any branch or to any tag.
- The creation of the repository itself.
- Switching Dependabot alerts on.
Notably, the list does not mention issues, pull request comments or stars. A repository that gets plenty of discussion but no new commits could still be seen as idle under these rules, so maintainers should not assume that a busy issue tracker keeps alerts running.
How to Turn Alerts Back On
Two paths bring alerts back. The first is simply pushing to the repository, which re-enables Dependabot alerts automatically. The second is switching them on by hand in the repository's security settings.
Either way, the archived alerts return and GitHub starts the twelve-month count again. That means a dormant library that suddenly needs a fix will not start from a blank slate. Its earlier findings return with it.
Which Repositories Are Excluded
Organizations that want alerts to stay on no matter what have two options. Repositories under an enforced security configuration with Dependabot alerts turned on are never paused. It will also leave alone repositories inside enterprises whose Dependabot policy stops repository administrators from enabling or disabling alerts.
All github.com plans are in scope, as is the data residency edition of GitHub Enterprise Cloud, where archived alerts are kept in the customer's own region alongside its other data. GitHub Enterprise Server is not affected.
What It Means for Developers
Inactive does not mean unused. Many teams depend on stable internal libraries, deployment scripts or older services that rarely see commits but still run in production. Once alerts pause, a newly published vulnerability in one of their dependencies may go unnoticed.
Before December 8, list repositories that have not received a push in about a year and decide which ones still matter. For those, the cleanest organization-wide fix is to enforce a security configuration with Dependabot alerts switched on, because it keeps alerts on regardless of activity.
Smaller teams can switch alerts back on manually, but remember that this starts a fresh twelve-month clock rather than a permanent setting. For repositories that are truly retired, archiving them on GitHub is a clearer signal than leaving them to drift. Recent related changes include Dependabot version updates for Agent Package Manager and secret scanning for Actions workflow logs.
How to Prepare
A practical checklist for the coming weeks:
- Find repositories with no pushes in the last twelve months and mark which ones are still deployed or consumed by other projects.
- Apply an enforced security configuration with Dependabot alerts on for the repositories that must stay watched.
- Review the enterprise Dependabot alerts policy if you run GitHub Enterprise Cloud.
- Archive repositories that are genuinely no longer in use so their status is clear to everyone.
Conclusion
GitHub is narrowing Dependabot alerts to repositories that show signs of life, starting December 8, 2026. Nothing is deleted and a single push restores everything, but quiet repositories that still run in production could lose their warnings. A few minutes spent on security configurations now avoids a blind spot later.
Sources
See my articles more often when you search Google.
