Enable Dependabot alerts to be generated when a new vulnerable dependency is found in one of your repositories.
When Dependabot detects vulnerable dependencies in a repository, it generates alerts. For more information, see Dependabot alerts.
You can enable or disable Dependabot alerts for:
You can enable or disable Dependabot alerts for all repositories owned by your personal account.
When you enable Dependabot alerts for existing repositories, you will see any results displayed on GitHub within minutes.
You can manage Dependabot alerts for your public, private or internal repository.
By default, we notify people with write, maintain, or admin permissions in the affected repositories about new Dependabot alerts. GitHub never publicly discloses insecure dependencies for any repository. You can also make Dependabot alerts visible to additional people or teams working on repositories that you own or have admin permissions for.
If you enable security and analysis features, GitHub performs read-only analysis on your repository.
On GitHub, navigate to the main page of the repository.
Under your repository name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.
In the "Security and quality" section of the sidebar, click Advanced Security.
Under "Advanced Security", to the right of Dependabot alerts, click Enable to enable alerts or Disable to disable alerts.
You can enable Dependabot alerts for all eligible repositories in your organization. For more information, see Enabling security features at scale.
Additionally, you can use Dependabot auto-triage rules to manage your alerts at scale, so you can auto-dismiss or snooze alerts, and specify which alerts you want Dependabot to open pull requests for. For information about the different types of auto-triage rules, and whether your repositories are eligible, see Dependabot auto-triage rules.