An unchanged repository can still be in use
GitHub announced on November 10 that it will begin suspending Dependabot alerts on most repositories after a year without qualifying activity. The change starts December 8, 2026. For maintainers, the useful distinction is between a repository that receives no code changes and software that nobody uses. A stable component may still run in production or appear in another project’s dependency chain.
GitHub counts a repository’s creation, a push to any branch or tag, or enabling Dependabot alerts as activity. Its announcement does not list issue discussions or pull-request reviews among those events.
Know how monitoring can resume
An affected repository’s existing alerts will be archived. GitHub says a subsequent push or manually enabling alerts in settings restores them and resets the annual inactivity period. Its configuration guide places the alert control under the repository’s Advanced Security settings.
CGH’s assessment is that teams should identify the repositories they continue to depend on before treating inactivity as a maintenance signal. For a dormant production component, ownership of vulnerability monitoring remains a practical responsibility even when the code itself needs no change.
Some centrally managed repositories are exempt
GitHub says enforced security configurations and enterprise policies that require alerts can prevent suspension. The change covers all GitHub.com plans and Enterprise Cloud with data residency. Enterprise Server is excluded.
The announcement specifies no additional charge or country-specific rollout schedule. CGH reviewed the policy and configuration documentation without testing a suspension or changing any repository’s security settings.