That old GitHub repository you haven’t touched in a year may stop receiving new Dependabot alerts. GitHub has announced a change starting December 8, 2026—and there’s an easy way to avoid surprises.
What’s changing?
According to GitHub’s November 10 announcement, Dependabot alerts will be switched off for most repositories that have had no qualifying activity in the previous year.
Existing alerts will be archived, not deleted. This matters if you maintain an older library, a rarely updated website, or a project you plan to revive.
What counts as repository activity?
GitHub specifically lists three events:
- Pushes to any branch or tag.
- Creation of the repository.
- Enabling Dependabot alerts.
Simply reading the repository or opening its page isn’t on that list. Don’t assume an occasional visit will keep scanning active.
How to keep security alerts working
- Check important dormant projects: open each repository’s security settings and confirm Dependabot alerts are enabled.
- Restore a paused repository: a push automatically re-enables alerts, or you can turn alerts back on in repository settings. Archived alerts return, and the one-year clock restarts.
- Manage important repositories centrally: an enforced security configuration that enables alerts exempts repositories from this inactivity rule.
GitHub also exempts repositories in enterprises whose Dependabot alerts policy prevents repository administrators from changing that setting. See the official configuration documentation for the settings workflow.
Who is affected?
The change applies to all plans on github.com and GitHub Enterprise Cloud with data residency. GitHub Enterprise Server is not affected. For data-residency customers, archived alerts remain in their enterprise’s region.
Quick takeaway: before December 8, review dormant but still-deployed repositories. If a project remains in production, don’t mistake a quiet alert dashboard for proof that its dependencies are safe.
Caveat: this announcement concerns Dependabot alerts; it doesn’t say every GitHub security feature stops on inactive repositories. Re-enabling alerts also doesn’t replace patching vulnerable dependencies.