Dependabot is creating noise, not security. The automated tool floods developers with thousands of low-value pull requests, even for vulnerabilities in code paths no one uses. A recent filippo.io/edwards25519 security fix triggered alerts for 228,000 dependent repositories, despite the vulnerable method being unused by nearly all.

This alert fatigue undermines security by making proper triage impractical. When every dependency update triggers a security notification, teams default to automatic merges rather than assessing actual risk. The problem is especially acute in the Go ecosystem, where the Go Vulnerability Database contains rich metadata including package and symbol-level information that better tools can leverage.

Instead of Dependabot's blanket approach, developers should use govulncheck with a scheduled GitHub Action. This tool filters vulnerabilities based on actual code reachability, using static analysis to determine if your project even calls the vulnerable function. For the edwards25519 case, govulncheck correctly identified zero vulnerabilities because the project only imported an unaffected subpackage. The solution is simple: replace Dependabot with a daily govulncheck Action that only notifies you of genuine threats requiring attention.