Do not read 500 alerts one by one. Filter out development-scope items, flag anything on the CISA exploited list, group the rest by package, fix the packages that clear many alerts at once, and dismiss the remainder with written reasons. Most backlogs shrink sharply after the first two passes.
Why backlogs grow
Alerts arrive whenever an advisory is published against something you already use. Nobody has to make a mistake for the count to rise. If an alert tool has been on for a year with no triage, a pile of several hundred is normal, not a sign of negligence.
The five passes
- Separate by scope. Filter to development dependencies. In GitHub you can use scope:development in the alert search. These are lower impact and can be handled in a separate batch.
- Flag exploited items. Compare the remaining advisories with the CISA Known Exploited Vulnerabilities catalog, which is published as CSV and JSON. Anything that matches goes to the top of the list.
- Group by package. Hundreds of alerts often point at a few dozen packages. One upgrade of a framework can close twenty alerts.
- Merge the easy upgrades. Where a fixed version exists and your tests pass, merge it. Dependabot security updates open pull requests that move a dependency to the minimum patched version.
- Dismiss the rest with reasons. Use the dismiss dropdown and write a short comment.
A worked example in numbers you can replicate
Imagine your export shows 500 alerts. After pass one you find 220 are dev-scope. After pass two, 3 match the exploited list. After pass three the remaining 280 collapse to 40 packages. You now have a plan of 3 urgent upgrades, 40 grouped upgrades, and a dev batch. That is a few afternoons, not a quarter.
Be careful with bulk security updates
Enabling security updates means Dependabot tries to open a pull request for every open alert with an available patch. On a large backlog this can flood you with pull requests. GitHub notes that if you want to choose which alerts get pull requests, you can leave security updates off and use auto-triage rules instead. Turn it on after you have cleaned up, so it handles new arrivals.
Stop the backlog coming back
Run a weekly routine: new alerts reviewed every week, no more than a handful open that are older than a month. Keep a number you can state, such as how many open alerts are older than 30 days.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is it safe to bulk dismiss alerts?
It is safe when each batch has a stated reason, such as dev scope or unreachable code, and when exploited items were removed first. Dismissing blindly is not safe.
Should I turn off alerts until I catch up?
No. Keep alerts on so new exploited items still reach you. Triage the old pile separately.
Safeguard dependency scanning can list findings with fix versions in one place, and its free scan is at gold.safeguard.sh/scan.
Sources
- GitHub Docs, about Dependabot security updates
- GitHub Docs, viewing and updating Dependabot alerts
- CISA Known Exploited Vulnerabilities Catalog
Last reviewed: 19 October 2026.
