From 912388b17df9d1380b3d618974b619f78f9631a4 Mon Sep 17 00:00:00 2001 From: Faith Moraa Ombongi <14026935+FaithOmbongi@users.noreply.github.com> Date: Mon, 12 Oct 2026 20:06:13 +0300 Subject: [PATCH 1/2] Update Dependabot options reference for pull request limits Clarified the limits on open pull requests for security updates and added information about error reporting when limits are reached. --- .../supply-chain-security/dependabot-options-reference.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/code-security/reference/supply-chain-security/dependabot-options-reference.md b/content/code-security/reference/supply-chain-security/dependabot-options-reference.md index e55131962f6c..467cbf6841fd 100644 --- a/content/code-security/reference/supply-chain-security/dependabot-options-reference.md +++ b/content/code-security/reference/supply-chain-security/dependabot-options-reference.md @@ -542,13 +542,15 @@ Change the limit on the maximum number of pull requests for version updates open * If five pull requests with version updates are open, no further pull requests are raised until some of those open requests are merged or closed. > [!NOTE] -> _Security update_ pull requests are not subject to this limit and do not count toward it. There is no limit on the number of open pull requests for security updates. +> _Security update_ pull requests are subject to a separate, fixed limit of 10 open pull requests, which cannot be configured using `open-pull-requests-limit`. When `open-pull-requests-limit` is defined: * {% data variables.product.prodname_dependabot %} opens pull requests up to the defined integer value. A large value can be set to effectively remove the open pull request limit. * You can temporarily disable version updates for a package manager by setting this option to zero, see [Disabling {% data variables.product.prodname_dependabot_version_updates %}](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-version-updates#disabling-dependabot-version-updates). +When either limit is reached, {% data variables.product.prodname_dependabot %} reports an error and stops opening additional pull requests until some of the open pull requests are merged or closed. For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-errors#pull-request-limit-reached). + ## `package-ecosystem` {% octicon "versions" aria-label="Version updates only" height="24" %} From 90a36112ec3b7a4f83522ed35c3497ab5e148343 Mon Sep 17 00:00:00 2001 From: Faith Moraa Ombongi <14026935+FaithOmbongi@users.noreply.github.com> Date: Mon, 12 Oct 2026 20:10:29 +0300 Subject: [PATCH 2/2] nit --- .../supply-chain-security/dependabot-options-reference.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/code-security/reference/supply-chain-security/dependabot-options-reference.md b/content/code-security/reference/supply-chain-security/dependabot-options-reference.md index 467cbf6841fd..7e25713ea3fe 100644 --- a/content/code-security/reference/supply-chain-security/dependabot-options-reference.md +++ b/content/code-security/reference/supply-chain-security/dependabot-options-reference.md @@ -542,7 +542,7 @@ Change the limit on the maximum number of pull requests for version updates open * If five pull requests with version updates are open, no further pull requests are raised until some of those open requests are merged or closed. > [!NOTE] -> _Security update_ pull requests are subject to a separate, fixed limit of 10 open pull requests, which cannot be configured using `open-pull-requests-limit`. +> _Security update_ pull requests are subject to a separate, fixed limit of 10 open pull requests, which cannot be configured using `open-pull-requests-limit`. When `open-pull-requests-limit` is defined: