Policy
Dependabot alerts will pause on inactive repositories
GitHub Changelog · By Allison ·
The Brief
- From December 8, 2026, GitHub will turn off Dependabot alerts on most repositories with no activity in the past year.
- Existing alerts on those repositories are archived, not deleted, and can be restored at any time.
- GitHub cites growing vulnerability discovery and alert volume as the reason for the change.
Why it matters
Inactive repositories will stop receiving new Dependabot vulnerability alerts, so maintainers of dormant projects must check for issues themselves or reactivate the repository to keep receiving them.
Who’s affected
- Maintainers of GitHub repositories with no activity in the past year
What to do
- Restore archived alerts or reactivate inactive repositories if you still need Dependabot alerts after December 8, 2026
- #github
- #dependabot
- #security alerts
- #dependencies
- #repositories
Starting December 8, 2026, GitHub will turn off Dependabot alerts on most repositories with no activity in the past year. Their existing alerts are archived, not deleted, and you can restore them at any time. With vulnerability discovery and alert volume growing quickly, this…
Timeline
GitHub announces Dependabot alerts will pause on inactive repositories
Archive: 2026 - GitHub Changelog
Dependabot alerts will pause on inactive repositories
Dependabot alerts turned off on inactive repositories