A Dependabot alert means a dependency in your repository matches a vulnerability in the GitHub Advisory Database. GitHub raises it when a new advisory is added or when your dependency graph changes. The alert links to the affected file and shows severity and, when available, a fixed version.
When alerts fire
GitHub's documentation says Dependabot scans the default branch and sends an alert in two cases:
- A new vulnerability is added to the GitHub Advisory Database.
- Your dependency graph changes, for example when a commit updates a package or version.
So an alert can appear on a quiet repository. Nothing in your code changed. The world learned something about a package you already used.
What the alert needs
Detection depends on the dependency graph, which GitHub generates when alerts are enabled. Keep manifest and lock files current and committed. The docs also list limits: alerts do not cover archived repositories, only cover advisories GitHub has reviewed, and do not cover GitHub Actions that use semantic versioning instead of pinned commit SHAs.
What an alert shows
- A link to the affected file.
- Details of the vulnerability and its severity.
- The fixed version, when one exists.
Alerts live under the repository's Security tab and in the dependency graph.
A triage routine for a student project
| Step | Question |
|---|---|
| 1 | Is the package direct or transitive? |
| 2 | Does a fixed version exist? |
| 3 | Is the upgrade a patch, minor or major change? |
| 4 | Does my code use the affected feature? |
| 5 | Do tests pass after the upgrade? |
Work from cheap and safe to expensive. A patch version bump with passing tests can be merged quickly. A major version change deserves its own branch and a read of the release notes.
What an alert does not tell you
It does not say whether you are exploitable. A vulnerable function may never be called by your code. That judgment is called reachability, and it is the difference between a long list and a short one. Our post on how reachability cuts the noise shows the idea.
Dismissing with discipline
If you decide an alert does not apply, write the reason in the dismissal. Future you, or a teammate, will need it. Do not dismiss simply to clear the count.
Where Safeguard fits
Safeguard provides dependency scanning with reachability analysis to show which advisories your code can reach. A free scan lets you try it on a repository.
Try it yourself
Open the demo and see how a reachability check reduces a long alert list to the findings that matter.
Click through it at your own pace, or open it full screen.
Quick check
Why did I get an alert when I changed nothing?
A new advisory was added to the database that matches a package you already use.
Do Dependabot alerts cover every advisory?
No. The documentation says they cover advisories GitHub has reviewed.
Sources
Last reviewed: 19 October 2026.
