Custom auto-triage rules for Dependabot alerts enter public beta

Since GitHub introduced its curated Dependabot policies in May, more than 250,000 repositories have opted in, and the auto-dismissal engine has cleared millions of alerts that otherwise would have required manual review. Today, that same mechanism is being opened up: custom auto-triage rules are now in public beta, letting teams define their own criteria for how Dependabot handles alert dismissal and reopening.

The feature is free for public repositories and included with GitHub Advanced Security for private repositories. It sits alongside the existing auto-triage presets and improved alert metadata, with the goal of offloading routine alert triage so developers can concentrate on code rather than administrative overhead.

How rules work

An auto-triage rule pairs a set of conditions with an action. When an alert—current or future—matches the conditions in a rule, Dependabot applies the specified behavior automatically.

From the rules list view, you can manage GitHub-curated presets and create your own custom rules to auto-triage alerts.

In this first beta, two actions are available:

  • Ignore: Dismiss matching alerts.
  • Snooze until patch: Hold alerts until a patched version is released.

Rules are defined at the repository level for now; organization-level rule management is planned for a follow-up release. All automated decisions are recorded under the auto-dismiss alert resolution, which keeps a clear audit trail, works with existing reporting and workflow integrations, and allows alerts to be reintroduced if their metadata changes.

Alert criteria you can target

Custom rules can match alerts on several attributes. As of today, the supported criteria are:

Custom rules can be created across stackable attributes related to dependencies and the advisory.

Attribute Description
severity Alert severity, based on CVSS base score, across the following values: low, medium, high, and critical.
scope Scope of the dependency: development (devDependency) or runtime (production).
package-name Packages, listed by package name.
cwe CWEs, listed by CWE ID.
ecosystem Ecosystems, listed by ecosystem name.
manifest Manifest files, listed by manifest path.

Availability

GitHub-curated presets, such as the auto-dismissal of false positives, remain free for everyone on all repositories. Custom auto-triage rules are free on public repositories and available through GitHub Advanced Security for private ones.

Read our collection of posts to learn more about GitHub Advanced Security.

Roadmap

During the beta period, the GitHub team is collecting feedback and working on additional alert metadata and enforcement options to extend what custom rules can do. New configurability for Dependabot security updates is also in progress, intended to give teams finer control over remediation workflows. Updates will appear in the GitHub Changelog.