# Turn Dependabot Off

DevFeed: [Turn Dependabot Off](<https://devfeed.tech/articles/turn-dependabot-off-20694.md>)

Original publisher: [Read original article](<https://words.filippo.io/dependabot/>)

Author: Filippo Valsorda

Published: 2026-02-20T19:48:08Z

Content type: opinion

Language: en

Sources: [Filippo Valsorda](<https://devfeed.tech/sources/filippo-valsorda.md>)

Topics: [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [Go Language](<https://devfeed.tech/topics/go-language.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [ci](<https://devfeed.tech/topics/ci.md>)

Tags: [ci](<https://devfeed.tech/tags/ci.md>), [dependabot](<https://devfeed.tech/tags/dependabot.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [go](<https://devfeed.tech/tags/go.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability-scanner](<https://devfeed.tech/tags/vulnerability-scanner.md>)

## AI overview

The article argues that Dependabot creates excessive and often irrelevant security-alert noise in the Go ecosystem. It recommends replacing Dependabot with scheduled GitHub Actions that run govulncheck and tests against the latest dependency versions, and using vulnerability scanners that filter by package and vulnerable-symbol reachability.

## Source excerpt

I recommend turning Dependabot off and replacing it with a pair of scheduled GitHub Actions, one running govulncheck, and the other running CI against the latest version of your dependencies.