Configuring notifications for vulnerable dependencies

Optimize how you receive notifications about Dependabot alerts.

About notifications for vulnerable dependencies

When Dependabot detects vulnerable dependencies in your repositories, we generate a Dependabot alert and display it on the Security tab for the repository. GitHub notifies the maintainers of affected repositories about the new alert according to their notification preferences. Dependabot is enabled by default on all public repositories. For Dependabot alerts, by default, you will receive Dependabot alerts by email, grouped by the specific vulnerability.

If you're an organization owner, you can enable or disable Dependabot alerts for all repositories in your organization with one click. You can also set whether the detection of vulnerable dependencies will be enabled or disabled for newly-created repositories. For more information, see "Managing security and analysis settings for your organization."

Configuring notifications for Dependabot alerts

You can configure notification settings for yourself or your organization from the Manage notifications drop-down shown at the top of each page. Weitere Informationen findest Du unter „Benachrichtigungen konfigurieren."

You can choose the delivery method and frequency of notifications about Dependabot alerts on repositories that you are watching or where you have subscribed to notifications for security alerts.

By default, you will receive notifications:

  • by email, an email is sent when Dependabot is enabled for a repository, when a new manifest file is committed to the repository, and when a new vulnerability with a critical or high severity is found (Email each time a vulnerability is found option).
  • in the user interface, a warning is shown in your repository's file and code views if there are any vulnerable dependencies (UI alerts option).
  • on the command line, warnings are displayed as callbacks when you push to repositories with any vulnerable dependencies (Command Line option).
  • in your inbox, as web notifications. A web notification is sent when Dependabot is enabled for a repository, when a new manifest file is committed to the repository, and when a new vulnerability with a critical or high severity is found (Web option).
  • on GitHub für Mobilgeräte, as web notifications. For more information, see "Enabling push notifications with GitHub for mobile."

Note: The email and web/GitHub für Mobilgeräte notifications are:

  • per repository when Dependabot is enabled on the repository, or when a new manifest file is committed to the repository.

  • per organization when a new vulnerability is discovered.

You can customize the way you are notified about

Dependabot alerts. For example, you can receive a weekly digest email summarizing alerts for up to 10 of your repositories using the Email a digest summary of vulnerabilities and Weekly security email digest options.

Dependabot alerts options

Note: You can filter your notifications on GitHub to show Dependabot alerts. Weitere Informationen findest Du unter „Benachrichtigungen über Deinen Posteingang verwalten."

Email notifications for Dependabot alerts that affect one or more repositories include the X-GitHub-Severity header field. You can use the value of the X-GitHub-Severity header field to filter email notifications for Dependabot alerts. Weitere Informationen findest Du unter „Benachrichtigungen konfigurieren.“

How to reduce the noise from notifications for vulnerable dependencies

If you are concerned about receiving too many notifications for Dependabot alerts, we recommend you opt into the weekly email digest, or turn off notifications while keeping Dependabot alerts enabled. You can still navigate to see your Dependabot alerts in your repository's Security tab. For more information, see "Viewing and updating vulnerable dependencies in your repository."

Weiterführende Informationen

Did this doc help you?Privacy policy

Help us make these docs great!

All GitHub docs are open source. See something that's wrong or unclear? Submit a pull request.

Make a contribution

Oder, learn how to contribute.