Author: Nadali. Prepared using AI.
On November 10, GitHub announced that, from December 8, 2026, Dependabot alerts will be disabled on most repositories inactive for a year. Activity means a push to any branch or tag, repository creation or enabling alerts.
This covers GitHub.com plans and Enterprise Cloud with data residency, not Enterprise Server. Enforced configurations enabling alerts and enterprise policies preventing repository administrators from toggling them are exceptions. Alerts are archived; enabling them manually or pushing restores them and restarts the year.
Why small businesses should check
A small website, chatbot or integration may still run even though its code has not changed for a long time. This is an illustrative scenario: a lack of development does not establish that a service is no longer needed.
According to GitHub’s documentation, Dependabot identifies known dependency vulnerabilities on the default branch. It does not cover every security issue. When it is first enabled, do not expect an individual notification for every vulnerability already found: review the alert list in the repository itself.
What to ask your contractor
Our editorial recommendations for the business owner and technical contractor:
- List live services and their code. Match the website, order form, AI assistant and integrations to their repositories. Record who maintains each one.
- Review activity and current policies. Ask an administrator to determine whether each repository falls under the announced change. A working website alone cannot answer that question.
- Agree how alerts will be maintained. Do not push arbitrary production-code changes merely to create activity. Reviewing settings should be a controlled action by an authorized administrator.
- Assign responsibility for the results. Identify who assesses alerts, reviews proposed fixes and tests the service after dependency updates.
The configuration guide gives the path Settings → Advanced Security → Dependabot alerts. Check the applicable access and organization policies in your own environment.
The takeaway: find quiet repositories that still support the business and assign responsibility for their security before the December change. Nadali read the three primary sources on November 10, 2026, has not inspected readers’ accounts or repositories and does not establish that they are vulnerable.
Cover: an original Nadali AI illustration about maintaining alerts for a long-unchanged project, created for this article; not GitHub’s interface.
