configuring-notifications-for-dependabot-alerts.md

title	shortTitle	intro	redirect_from	versions	type	topics
Configuring notifications for Dependabot alerts	Configure notifications	Optimize how you receive notifications about {% data variables.product.prodname_dependabot_alerts %}.	/github/managing-security-vulnerabilities/configuring-notifications-for-vulnerable-dependencies /code-security/supply-chain-security/configuring-notifications-for-vulnerable-dependencies /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-notifications-for-vulnerable-dependencies	fpt ghes ghec * * *	how_to	Dependabot Alerts Notifications Vulnerabilities Dependencies Repositories

About notifications for {% data variables.product.prodname_dependabot_alerts %}

When {% data variables.product.prodname_dependabot %} detects vulnerable dependencies in your repositories, we generate a {% data variables.product.prodname_dependabot %} alert and display it on the Security tab for the repository. {% data variables.product.product_name %} notifies the maintainers of affected repositories about the new alert according to their notification preferences.{% ifversion fpt or ghec %} {% data variables.product.prodname_dependabot %} is enabled by default on all public repositories, and needs to be enabled on private repositories. By default, you will receive {% data variables.product.prodname_dependabot_alerts %} by email. You can override the default overall behavior by choosing the type of notifications you want to receive, or switching notifications off altogether in the settings page for your user notifications at https://github.com/settings/notifications. {% endif %}

{% data reusables.dependabot.no-dependabot-alerts-for-malware %}

{% ifversion dependabot-suppressed-notifications %}Regardless of your notification preferences, when {% data variables.product.prodname_dependabot %} is first enabled, {% data variables.product.product_name %} does not send notifications for all vulnerable dependencies found in your repository. Instead, you will receive notifications for new vulnerable dependencies identified after {% data variables.product.prodname_dependabot %} is enabled, if your notification preferences allow it.{% endif %}

{% ifversion fpt or ghec %}If you're an organization owner, you can enable or disable {% data variables.product.prodname_dependabot_alerts %} for all repositories in your organization with one click. You can also set whether {% data variables.product.prodname_dependabot_alerts %} will be enabled or disabled for newly-created repositories. For more information, see "AUTOTITLE." {% endif %}

{% ifversion ghes %} By default, if your enterprise owner has configured email for notifications on your enterprise, you will receive {% data variables.product.prodname_dependabot_alerts %} by email.

Enterprise owners can also enable {% data variables.product.prodname_dependabot_alerts %} without notifications. For more information, see "AUTOTITLE." {% endif %}

Configuring notifications for {% data variables.product.prodname_dependabot_alerts %}

When a new {% data variables.product.prodname_dependabot %} alert is detected, {% data variables.product.product_name %} notifies all users with access to {% data variables.product.prodname_dependabot_alerts %} for the repository according to their notification preferences. You will receive alerts if you are watching the repository, have enabled notifications for security alerts or for all the activity on the repository, and are not ignoring the repository. For more information, see "AUTOTITLE."

You can configure notification settings for yourself or your organization from the Manage notifications drop-down {% octicon "bell" aria-label="The notifications bell" %} shown at the top of each page. For more information, see "AUTOTITLE."

{% data reusables.notifications.vulnerable-dependency-notification-delivery-method-customization2 %} {% data reusables.notifications.vulnerable-dependency-notification-options %}

{% ifversion update-notification-settings-22 %} {% endif %}{% ifversion ghes %} {% endif %}

{% note %}

Note: You can filter your notifications on {% data variables.product.company_short %} to show {% data variables.product.prodname_dependabot_alerts %}. For more information, see "AUTOTITLE."

{% endnote %}

{% data reusables.repositories.security-alerts-x-github-severity %} For more information, see "AUTOTITLE."

How to reduce the noise from notifications for {% data variables.product.prodname_dependabot_alerts %}

If you are concerned about receiving too many notifications for {% data variables.product.prodname_dependabot_alerts %}, we recommend you opt into the weekly email digest, or turn off notifications while keeping {% data variables.product.prodname_dependabot_alerts %} enabled. You can still navigate to see your {% data variables.product.prodname_dependabot_alerts %} in your repository's Security tab. For more information, see "AUTOTITLE."

Further reading

• "AUTOTITLE"
• "AUTOTITLE"