Starting Dec 8, 2026, GitHub will pause Dependabot alerts on most repositories inactive for a year, archiving existing alerts. A push or manual re-enable restores them; enforced enterprise security policies are exempt.

GitHub’s original policy notice showing the December 8, 2026 start date, one-year inactivity rule and ways to restore archived Dependabot alerts.

Published 10 Nov 2026 · 16:06 UTC

GitHub Changelog ↗ · Source dated 10 Nov 2026

Starting Dec 8, 2026, GitHub will pause Dependabot alerts on most repositories inactive for a year, archiving existing alerts. A push or manual re-enable restores them; enforced enterprise security policies are exempt. · ournews.ai