Dependabot Alerts on Inactive Repositories: December 2026

GitHub announced on November 10, 2026 that it will turn off Dependabot alerts on most repositories with no activity during the previous year, beginning December 8. Existing alerts will be archived rather than deleted. The change is intended to reduce alert-processing load while keeping monitoring focused on repositories GitHub considers active. It also creates a governance risk: an old repository can remain deployed, embedded or depended upon even when no one pushes to it.

GitHub defines activity narrowly

A push to any branch or tag, repository creation, or turning on Dependabot alerts resets the one-year clock. Issues, downloads, deployments and downstream use are not listed as qualifying activity in the announcement. A repository can therefore be operationally important while appearing inactive under this rule.

Security teams should inventory archived, read-only and maintenance-mode repositories before December 8. Classify whether each one is genuinely retired, still deployed, used as a dependency or retained for incident recovery. Do not manufacture meaningless commits simply to keep a dashboard green.

Archived alerts can be restored

Any push automatically turns alerts back on and restores archived findings. Repository administrators can also re-enable alerts through settings, which restarts the one-year clock. Archived does not mean resolved: a vulnerability can still affect the code or a deployed artifact while its alert is hidden from the active view.

Teams should preserve ownership and escalation paths for dormant repositories. If the code returns to active development, review the restored backlog before release rather than assuming the new push makes dependencies safe.

Security configurations and enterprise policy can keep monitoring active

GitHub will not pause alerts where an enforced security configuration enables them. It also excludes repositories in enterprises whose Dependabot policy prevents repository administrators from changing alert enablement. The rule applies across github.com plans and Enterprise Cloud with data residency, but not GitHub Enterprise Server.

For Canadian organizations, the useful control is an enforced policy tied to asset criticality, not developer activity alone. Document the repository owner, deployed consumers, retention reason and review date. Data-residency customers retain archived alerts in their selected region, according to GitHub.

Sources and editorial method

We use the linked original statements and reports to distinguish documented facts from our analysis. Company announcements describe their authors’ plans and claims; they are not independent verification of future outcomes. This article is dated and will be revised if material evidence changes. Read our editorial standards and corrections process.

GitHub: Dependabot alerts will pause on inactive repositories ↗ — Official November 10, 2026 announcement; start date, activity definition, restoration, exceptions and scope.