Closed Dependabot alerts: announced retention and archive access
The news at the time
GitHub’s notice scheduled a retention change for 2026-09-25, beginning with closed Dependabot security alerts on github.com and Enterprise Cloud. It explicitly excludes Enterprise Server; the announcement alone does not verify completion of the rollout.
Under the announced policy, open alerts remain accessible regardless of age, while closed alerts remain in the UI and API for 2 years after closure. Older closed alerts move to downloadable CSV archives for authorized administrators and security managers rather than remaining in API results.
Follow-up checked during renewal
No additional follow-up fact was established in this renewal. This does not establish that nothing changed.
What to review before applying this
Audit queries and compliance exports that rely on older closed alerts. Verify actual archive access and rollout status in the relevant account; do not apply this notice to every alert type or infer permanent retention after account or repository deletion.
Editorial review suggestions; no hands-on product experiment was performed.
Claim-by-claim source evidence
GitHub’s notice scheduled a retention change for 2026-09-25, beginning with closed Dependabot security alerts on github.com and Enterprise Cloud. It explicitly excludes Enterprise Server; the announcement alone does not verify completion of the rollout.
Starting September 25, 2026, GitHub will introduce a data retention policy for closed Dependabot security alerts.
Evidence source ↗
It does not apply to GitHub Enterprise Server (GHES).
Evidence source ↗
Under the announced policy, open alerts remain accessible regardless of age, while closed alerts remain in the UI and API for 2 years after closure. Older closed alerts move to downloadable CSV archives for authorized administrators and security managers rather than remaining in API results.
Open alerts stay fully accessible in the UI and API, regardless of age.
Evidence source ↗
Closed alerts stay fully accessible in the UI and API for two years after they are closed.
Evidence source ↗
Enterprise, organization, and repository administrators and security managers can download them as a CSV
Evidence source ↗
Korean digest for the historical date: 2026-07-01. Quotations and source context were reviewed editorially; this is not an independent experimental verification.
Discussion