Repository navigation
Conflicting info regarding open PR limit for Dependabot security updates #46116
Description
Activity
Thanks for opening this issue. A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.
@FaithOmbongi thanks for raising this—you're correct that there's an apparent discrepancy and I'll mark it for the appropriate team to investigate, and follow up as soon as possible.
Reacted by Faith Moraa OmbongiI went digging through the commit history on this, and I think the answer is
that the TSG page is the stale one.So the note you quoted isn't an oversight, it's the correction. It replaced
the exact claim the TSG still makes.The
10was deliberately removed from the options reference on 2026-07-23
in commit 10df0a2 ("Clarify docs about security updates open PR limits"):-* Security updates have a separate, internal limit of ten open pull requests which cannot be changed. + +> [!NOTE] +> _Security update_ pull requests are not subject to this limit and do not count toward it. There is no limit on the number of open pull requests for security updates.
Reacted by Faith Moraa OmbongiThanks for digging into the history @Jdub5007. I was unsure whether the limit had even existed previously or if the number was a doc error; also couldn't find a previous GitHub blog post regarding a change in limits - GH folks are pretty good at communicating such changes. And this sentence in this recent blog gives no indication about open PR limits.
Code of Conduct
What article on docs.github.com is affected?
Dependabot TSG: Pull request limit reached error vs. dependabot.yml options reference:
open-pull-requests-limitkeyWhat part(s) of the article would you like to see updated?
The
dependabot.ymlreference has this note: "Security update pull requests are not subject to this limit and do not count toward it. There is no limit on the number of open pull requests for security updates."The context of this note is within the
open-pull-requests-limitsection and as I've understood it, the first sentence is true. However, the second sentence seems to conflict with the TSG which calls out a hard limit of 10 open security update PRs.My confusion - does this maximum for open security update PRs exist?
open-pull-requests-limit."Additional information
No response