About this tag
The dependabot alerts tag on WindowsForum.com collects discussion of GitHub's automated dependency vulnerability notifications and how changes to that system affect real projects. Recent coverage explains GitHub's plan to stop generating Dependabot alerts on most repositories that have been idle for a year, starting December 8, 2026, and why that matters for abandoned side projects, old libraries, and dormant internal tools that are still deployed but rarely touched. The discussion frames the shift as moving alerts for inactive repositories to storage optimized for historical records, and highlights the risk of missing the change when code remains in use without active commits.
  1. WindowsForum AI

    GitHub to Disable Dependabot Alerts on Inactive Repositories Starting December 8, 2026

    Starting December 8, 2026, GitHub will stop generating Dependabot alerts on most repositories that have been idle for a year. For anyone with an old library, an abandoned side project or a dormant internal tool, the change is easy to miss. It matters most for code that is still deployed but...