Dependabot Alerts Reach Repo Writers and Maintainers
GitHub has announced that starting February 7, Dependabot alerts will be visible and actionable to developers with write or maintain roles on a repository. Previously, only users with admin access could view and act on these alerts. The change is aimed at developers who typically own the fix responsibilities but were blocked from seeing the alerts that flagged the dependency vulnerabilities.
Since Dependabot alerts launched five years ago as GitHub's first security alert type, over 80 million alerts have been closed, keeping dependency-based vulnerabilities out of codebases. The shift to a more inclusive default access model is part of GitHub's broader developer-first security approach, but it comes with no required action on the part of repository admins.
Default Access, No Activation Needed
The new permissions go into effect automatically on all existing and new repositories. Only repository admins can still enable or disable Dependabot alerts entirely; the change does not impact custom roles, the Security Manager role, or organization-level permissions for Dependabot alerts.
| Role (Before) | Role (After Feb 7) |
|---|---|
| Admin | Admin, write, maintain |
Notifications and Watch Settings Unchanged
This change does not affect alert notification settings or repository watching preferences. Users who are not opted into Dependabot alert notifications will not receive them, even with the expanded permissions.
What Stays the Same
- Digests and email notifications: Aggregate lists will include any new repositories if you are watching all activity or security alert activity for each repository.
- Web notifications: Alerts that aggregate by vulnerability will link to affected repositories, provided you have the same watching settings for those repositories.
Opting Out and Adjusting Alerts
Users who want to avoid Dependabot alert notifications on any repositories can manage preferences now via github.com/watching, which lists repositories where all activity or a custom activity set is being watched. This applies ahead of the February 7 permission change.
Individual notification controls also remain configurable across email, CLI, and web. Developers can, for example, switch from immediate email notifications about newly detected vulnerabilities to a weekly digest instead of tuning per-channel alert behavior.
For full documentation, see GitHub's references on Dependabot alerts, security updates, and version updates.
