You do not need to stay logged in to notice dependency drift. When a GitHub, GitLab, or Azure DevOps sync, or a release promotion, leaves packages waiting for review, SourceTrust opens a drift window for that branch. Mail is not sent on every sync. Instead, each morning at 09:00 in your organization timezone, eligible recipients get one consolidated digest covering every project they should see.
What the email contains
- Subject: Review needed: {oldest project}, or that project plus how many more when several are due.
- Projects are listed oldest-open first, with package counts and a link to the Changes tab.
- At most one digest per recipient per day, even if many projects have drift.
Escalation ladder
While review work remains open on a branch, reminders escalate: first after 24 hours, then at 3 days, then a final notice at 7 days. New dependency changes on that branch reset the ladder. After the final notice, SourceTrust stops emailing for that window until new drift opens again. Manual file imports do not send these digests.
Who receives digests
Project leads get digests for their projects. Projects without leads use the organization notification list (the same fallback as security alerts). See Help center → Project leads (Project leads). The send time follows Organization timezone (Organization timezone).
Turning digests off
- Open the project → Settings → Dependency change emails.
- Turn the toggle off for that project. In-app drift banners and the Changes tab stay available.