GitHub opened a status incident at 14:58Z on October 23 after Dependabot alerts stopped closing on schedule. Repositories that had already been updated to fix the underlying vulnerability kept showing an open alert, a mismatch between the repo state and what Dependabot reported. As of 17:27Z the same day, GitHub listed the issue as still under investigation, the last update posted before this article went to press.
GitHub's own explanation points to a processing backlog rather than a detection or scanning failure. The company says more capacity is being rolled out to work through the queue, which implies the fix is operational, adding compute or workers, not a code change to Dependabot's logic. GitHub has explicitly stated this is not a security vulnerability. It has not disclosed how many repositories or alerts are affected, which ecosystems are involved, or a timeline for when closures catch up.
The practical effect for any team relying on Dependabot is a gap between actual risk and reported risk, running in the safer direction. A repo can be clean while its alert dashboard still lists an open finding tied to a dependency that has already been patched. That is an annoying but low-stakes failure mode compared to the reverse, where a real vulnerability goes unreported. Nothing in GitHub's update suggests new vulnerabilities are being missed or that scanning itself is impaired.
On-call engineers should treat any stale-looking Dependabot alert from this window with suspicion before escalating it as a fresh finding. Check whether the flagged repository has a merged fix or updated manifest that predates the alert's open status, since that pattern matches the behavior GitHub describes. Teams that gate deploys or compliance reports on a clean Dependabot count should expect noise until the backlog clears, and should avoid writing automation that auto-reopens tickets based solely on alert state during this period. What remains unresolved is scope, so blanket assumptions across every repository are not yet supported by GitHub's updates.
GitHub labeled the incident minor, and the fix path described, added capacity, is the kind of change that resolves quietly without a follow-up postmortem in most cases. Until GitHub posts a resolution update, the safest read is that Dependabot's alert counts are temporarily unreliable in one direction only, closed work not yet reflected as closed.