GitHub to pause Dependabot alerts on inactive repositories from December 8, 2026
Starting December 8, 2026, GitHub will turn off Dependabot alerts on most repositories with no activity in the past year. Existing alerts are archived rather than deleted, and users can re-enable them.
Why it matters
Builders maintaining dormant repositories will stop receiving Dependabot vulnerability alerts for those repos after the change date, so security monitoring for inactive projects must be handled another way if still needed.
Who should care
Developers and engineering teams maintaining GitHub repositories, especially owners of dormant or archived-in-practice projects, and security teams.
What you can do
Audit your GitHub repositories for inactivity over the past year and decide which ones need Dependabot alerts re-enabled or an alternative vulnerability scanning process before December 8, 2026.