Dependabot stops pestering dormant repositories

Dependabot generated over 75 million pull requests in 2022, helping developers keep dependencies current and remediate vulnerabilities at scale. That volume has a downside: repositories with stale, unmerged Dependabot pull requests generate noise that buries more relevant work. GitHub is addressing that with a new inactivity threshold that pauses automated Dependabot activity on repos where pull requests are consistently ignored.

The change follows an earlier adjustment that made version updates off-by-default for forks. Now, Dependabot will automatically stop opening and rebasing pull requests in repositories where no one interacts with them.

When Dependabot goes quiet

Dependabot pauses automated pull request activity only when every one of these conditions holds for 90 days:

  • No Dependabot pull request has been merged
  • No changes have been made to the Dependabot config file
  • No @dependabot comment-ops have been performed
  • No Dependabot pull requests have been closed by the user
  • At least one Dependabot pull request was received before the 90-day window
  • At least one Dependabot pull request is open at the end of the window
  • Dependabot was enabled for the entire period

Dependabot will also stop automatically rebasing pull requests after 30 days. When the pause kicks in, Dependabot notifies you via a banner on open Dependabot pull requests, the repository settings page (under "Dependabot"), and the Dependabot alerts page when security updates are affected.

Screenshot of an open pull request with a yellow banner indicating that Dependabot updates are paused. The banner includes instructions on how to resume updates by interacting with Dependabot.

What remains unchanged

The pause applies only to automatic pull request creation and rebasing. Dependabot alerts and their notifications are unaffected. You can still manually generate a Dependabot pull request from a vulnerability alert's details page at any time.

Resuming Dependabot activity

Dependabot unpauses itself as soon as you take one of several actions:

  • Merge a Dependabot pull request
  • Close a Dependabot pull request
  • Edit the Dependabot config file
  • Manually trigger a security update
  • Manually trigger a version update
  • Enable security updates
  • Use @dependabot commands on pull requests

Rollout schedule

The rollout began immediately, expanding through January 2023 to cover repositories owned by individuals and organizations on free and Team plans. GitHub Enterprise Cloud and GitHub Enterprise Server deployments follow shortly afterward, where the change also reduces load on self-hosted GitHub Actions runners.

GitHub says further work is underway to make Dependabot alerts and pull requests more relevant, building on community feedback collected through the GitHub Community Discussions.