Dependabot alerts turn off on idle repos Dec 8, 2026

What changed

Starting December 8, 2026, GitHub will turn off Dependabot alerts on most repositories with no activity in the past year. GitHub says the goal is to keep Dependabot fast and reliable for the repositories people are actively developing, as vulnerability discovery and alert volume grow quickly.

What counts as activity

GitHub counts pushing to any branch or tag, creating the repository, and turning on Dependabot alerts.

Who is exempt

GitHub won’t turn off alerts on repositories with an enforced security configuration that enables Dependabot alerts. It also skips repositories in enterprises whose Dependabot alerts policy doesn’t let repository administrators enable or disable alerts.

The change covers all plans on github.com and GitHub Enterprise Cloud with data residency, and doesn’t apply to GitHub Enterprise Server.

Getting alerts back

Any push to the repository turns Dependabot alerts back on automatically. You can also turn them on in the repository’s settings. Either way GitHub restores the archived alerts and the one-year clock starts over.

What to do

1. List repositories you still depend on but haven’t pushed to in a year.
2. Before Dec 8, 2026, push to them or plan to turn alerts on in settings.
3. Admins. Consider an enforced security configuration that enables Dependabot alerts for repositories that must always stay covered.