From 8 December 2026, most repositories inactive for a year will have their alerts paused and archived. A push or turning Dependabot alerts back on in repository settings will restore them, while some enforced security policies will prevent the pause.
GitHub plans to turn off Dependabot vulnerability alerts on most repositories that have had no activity for a year, starting 8 December 2026. The company announced the policy in its 10 November changelog, the sole source for the change. A repository is a place where a project’s files are stored.
Existing alerts will be archived rather than deleted. GitHub says vulnerability discoveries and alert volumes are growing quickly, and that the change will keep Dependabot fast and reliable for repositories under active development.
An earlier change on 13 October dealt with a different issue: GitHub made it easier to detect alerts withdrawn because the underlying advisory or vulnerability was no longer valid. That change improved notifications through a webhook action and responses through the REST API for software requesting those alerts; the new policy instead archives alerts when a repository is inactive.
GitHub counts creating a repository, turning on Dependabot alerts, or pushing changes to any branch or tag as activity. A push to an inactive repository will automatically turn alerts back on; maintainers can also enable them in repository settings. Either action restores archived alerts and restarts the one-year clock.
Alerts will stay on regardless of activity where an enforced security configuration enables them. GitHub will also skip repositories in enterprises whose Dependabot policy does not let repository administrators turn alerts on or off.
The policy covers all plans on github.com and GitHub Enterprise Cloud with data residency, but not GitHub Enterprise Server. For Enterprise Cloud data residency customers, archived alerts will be stored in the same region as the enterprise’s other data.
Companies pledge shutdown mechanisms for models they control as part of a political commitment adopted at a 9 November 2026 meeting with France’s president. The declaration sets no deadlines or sanctions.
2 min
The deployment covers DP World London Gateway, DP World Logistics Park, Ford Dagenham and two Port of Tilbury locations, giving port, logistics and manufacturing tenants dedicated connectivity for industrial applications.
3 min
Owners of Adventurer, Fury, Starfire, Nova and Capri glasses can install version 130, which Meta says is intended to stop the devices from getting too warm when excessive moisture or sweat enters them.
1 min
