# Dependabot alerts will pause on inactive repositories

Source: [Archive: 2026 - GitHub Changelog](https://github.blog/changelog/2026-11-10-dependabot-alerts-will-pause-on-inactive-repositories) · 2026-11-10 · Cloud & DevOps
Page: https://themorning.dev/story/dependabot-alerts-will-pause-on-inactive-repositories-b7cb9f6e519263ef
Kind: policy · Impact: medium

## In brief

- From December 8, 2026, GitHub will turn off Dependabot alerts on most repositories with no activity in the past year.
- Existing alerts on those repositories are archived, not deleted, and can be restored at any time.
- GitHub cites growing vulnerability discovery and alert volume as the reason for the change.

## Why it matters

Inactive repositories will stop receiving new Dependabot vulnerability alerts, so maintainers of dormant projects must check for issues themselves or reactivate the repository to keep receiving them.

## What to do

- Restore archived alerts or reactivate inactive repositories if you still need Dependabot alerts after December 8, 2026

## Timeline

- 2026-11-10: GitHub announces Dependabot alerts will pause on inactive repositories
- 2026-12-08: Dependabot alerts turned off on inactive repositories

## Coverage

- [Dependabot alerts will pause on inactive repositories](https://github.blog/changelog/2026-11-10-dependabot-alerts-will-pause-on-inactive-repositories) — Archive: 2026 - GitHub Changelog, 2026-11-10

Tags: github, dependabot, security alerts, dependencies, repositories

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev