Skip to content

Fix conflicting Dependabot security update PR limit (10, not unlimited) - #46160

Closed
Himanshucodess wants to merge 1 commit into
github:mainfrom
Himanshucodess:issue-46116
Closed

Himanshucodess wants to merge 1 commit into
github:mainfrom
Himanshucodess:issue-46116

Conversation

@Himanshucodess

Copy link
Copy Markdown

Summary

  • The 'open-pull-requests-limit' section of the Dependabot options reference claimed 'There is no limit on the number of open pull requests for security updates.'
  • That contradicts the Dependabot errors troubleshooting page ('Pull request limit reached'), which documents a limit of 10 open security update PRs and 5 (configurable via 'open-pull-requests-limit') version update PRs, with separate limits so version PRs cannot block security PRs.
  • Verified behavior: security update PR limit = 10 (not configurable via 'open-pull-requests-limit'); version update PR limit = 5 by default (configurable). This matches the troubleshooting page, the live docs, and community/secondary confirmation of a separate non-configurable internal limit of 10 for security updates.
  • Corrected the note in 'content/code-security/reference/supply-chain-security/dependabot-options-reference.md' to state the 10-PR security update limit, which is not configurable using 'open-pull-requests-limit'. No other occurrences of the incorrect 'no limit' claim were found repo-wide.

Validation

  • Ran: 'git diff --check' (clean), 'git status'/'git diff' review (single intended line changed), repo-wide 'git grep' for the incorrect sentence (no remaining occurrences) and for related limit statements (only the correct troubleshooting page entry remains).
  • Manually inspected Markdown syntax, front matter (untouched), links/anchors (untouched), and surrounding terminology (consistent).
  • NOT run: full npm lint/test suite (requires heavy install; impractical for a one-line docs change — CI on the PR will cover it).

Closes #46116

The open-pull-requests-limit reference claimed there is no limit on
open security update PRs, contradicting the Dependabot errors TSG which
documents a limit of 10 security update PRs (and 5 configurable version
update PRs, with separate limits).

Closes github#46116
@github-actions

github-actions Bot commented Oct 2, 2026

Copy link
Copy Markdown
Contributor

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

The table shows the files in the content directory that were changed in this pull request. This helps you review your changes on a staging server. Changes to the data directory are not included in this table.

Source Review Production What Changed
code-security/reference/supply-chain-security/dependabot-options-reference.md fpt
ghec
ghes@ 3.22 3.21 3.20 3.19 3.18
fpt
ghec
ghes@ 3.22 3.21 3.20 3.19 3.18

Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server

🤖 This comment is automatically generated.

@github-actions github-actions Bot added the triage Do not begin working on this issue until triaged by the team label Oct 2, 2026
@subatoi

subatoi commented Oct 2, 2026

Copy link
Copy Markdown
Contributor

This isn't open to contributors yet, so I'm going to close this out. Until an issue has help wanted attached, we haven't had time to do a proper assessment and we don't know whether it's something we need to fix internally, or how many articles are affected and what the scope of the fix will be. Sorry this won't have been the outcome you were hoping for.

@subatoi subatoi closed this Oct 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

triage Do not begin working on this issue until triaged by the team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Conflicting info regarding open PR limit for Dependabot security updates

2 participants