Dependabot alerts will pause on inactive repositories

Starting December 8, 2026, GitHub will turn off Dependabot alerts on most repositories with no activity in the past year. Their existing alerts are archived, not deleted, and you can restore them at any time. With vulnerability discovery and alert volume growing quickly, this keeps Dependabot fast and reliable for the repositories you’re actively developing.

What counts as activity

GitHub counts any of these as activity:

• Pushing to any branch or tag

• Creating the repository

• Turning on Dependabot alerts

Turn alerts back on

Any push to the repository automatically turns Dependabot alerts back on. You can also turn them on in the repository’s settings. Either way, GitHub restores the archived alerts, and the one-year clock starts over.

Keep alerts on regardless of activity

GitHub won’t turn off alerts on repositories with an enforced security configuration that enables Dependabot alerts. It also skips repositories in enterprises whose Dependabot alerts policy doesn’t allow repository administrators to enable or disable alerts.

This change applies to all plans on github.com and to GitHub Enterprise Cloud with data residency. For data residency customers, archived alerts are stored in the same region as the rest of your enterprise’s data. It doesn’t apply to GitHub Enterprise Server.