Security Alerts Only vs. Full Version Update Alerts with Ignore Rules: Which Minimizes Noise While Maximizing Coverage?

Goal: Reduce notification noise while still capturing critical updates

GitHub Dependabot offers two primary ways to manage alerts: enabling the "Security alerts only" toggle or keeping all version‑update alerts and applying ignore rules to specific dependencies or ranges. The former suppresses every non‑security notification, whereas the latter requires manual curation of ignored items to keep noise manageable.

The trade‑off lies in coverage versus noise. "Security alerts only" guarantees that only vulnerabilities trigger alerts, but it may miss important non‑security updates that could introduce compatibility problems. Ignoring dependencies can reduce noise, yet it risks delaying critical patches if the ignore list is not regularly reviewed. Additionally, Dependabot does not support granular severity filtering for version updates, treating all non‑security alerts equally.

Given these constraints, the choice is not obvious. The question remains: how to balance the need for a clean alert stream with the risk of missing non‑security but impactful changes?

Specific questions:

• How does the "Security alerts only" toggle affect the frequency and relevance of alerts in repositories with a mix of critical and non‑critical dependency updates?
• What best‑practice strategies can be employed to use ignore rules effectively while ensuring that essential non‑security updates are not overlooked?
• To what extent does the lack of granular severity filtering for version updates limit the practical usefulness of "Security alerts only" in large, complex codebases?