GitHub will switch off Dependabot alerts on repositories that have seen no activity in the past year, starting on 8 December 2026. The company announced the change on 10 November 2026, saying existing alerts will be archived rather than deleted, and can be restored at any time.

How the pause works

From 8 December, GitHub will check each repository for activity over the previous twelve months. If there has been none, Dependabot alerts are turned off for that repository, while its alert history moves into an archive so no record is lost. Any push to the repository automatically turns Dependabot alerts back on, and the archived alerts reappear with them.

What is exempt

The pause does not apply to every repository. GitHub will not switch off alerts on repositories covered by an enforced security configuration that enables Dependabot alerts, and it will skip repositories in enterprises whose Dependabot alerts policy does not allow repository administrators to enable or disable alerts. The change applies to all plans on github.com and to GitHub Enterprise Cloud with data residency, where archived alerts stay in the customer's own region. It does not apply to GitHub Enterprise Server.

Why GitHub is doing it

Dependabot alerts warn maintainers when a dependency they use has a known vulnerability, but alerts on abandoned projects pile up unread. By pausing alerts only where nothing has happened for a year, and restoring them the moment a repository becomes active again, GitHub aims to cut the noise without losing the safety net. Maintainers of quiet but still used projects should check whether their repository counts as active before 8 December. See the announcement on the GitHub Changelog and the summary at Vinish.Dev.