Repository navigation
Dependency graph and Dependabot alerts no longer enabled by default since 2025/06/17 #46501
Description
Code of Conduct
- I have read and agree to the GitHub Docs project's Code of Conduct
What article on docs.github.com is affected?
Based on this blog post Dependency graph now defaults to off and personally reproduced, Dependency graph and Dependabot alerts are no longer enabled by default.
A few docs still mention the old behavior:
- https://docs.github.com/en/code-security/concepts/supply-chain-security/dependency-graph - The alert box mentions "Public repositories (on by default)"
- https://docs.github.com/en/enterprise-server@3.19/code-security/getting-started/quickstart-for-securing-your-repository#managing-dependabot-alerts - Public repositories are enabled by default...
- https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-public-repositories - Other features are permanently enabled for public repositories, such as the dependency graph, which shows you all the libraries and packages that your repository depends upon.
- https://docs.github.com/en/enterprise-server@3.20/admin/configuring-settings/configuring-github-connect/enabling-dependabot-for-your-enterprise#enabling-dependabot-alerts - Public repositories are always enabled by default.
What part(s) of the article would you like to see updated?
Please see above links - we should update the reflect current behavior that Dependency graph and Dependabot alerts must be explicitly enabled even in public repos.
Additional information
See snippet of a screenshot for a new public repo.
Disclosure: The security features under my personal account are all in a disabled state - but I'm unable to recall whether I'd turned them off myself or if OFF is their default state (docs here don't mention the default state for the features in a personal account). If I'd turned them off myself, then likely the OFF state for the dependency graph and alerts is my fault; but if they're in the default state, then I think this issue remains valid.
Happy to raise a PR is the issue is valid.
Activity
subatoi commentedon Oct 27, 2026
Thanks @FaithOmbongi, this will be reviewed by the appropriate team
mchammer01 commentedon Oct 30, 2026
@FaithOmbongi 👋🏻 - thanks for the thorough writeup here, really appreciate it 💖
You're right, and the docs you've linked are confusing. Here's what I've confirmed internally:
We'll get the affected pages fixed internally to match the current behavior. Thanks again for flagging this 🙏
mchammer01 commentedon Oct 30, 2026
I will close this now as we have an internal issue for this.
FaithOmbongi commentedon Oct 31, 2026
Thanks @mchammer01 for investigating and reverting. Looking forward to the doc updates! 👊🏾