Skip to content

Commit 6a3447c

Browse files
asciimikejasonrudolphhubwriter
authored
Clarifying Dependabot version update frequency (#18027)
* Clarifying Dependabot version update frequency * Adding a small clarification to adding a new dependency * Fixing a broken link * Clarifying manifests only start updates after failed updates * Update data/reusables/dependabot/initial-updates.md Co-authored-by: Jason Rudolph <jason@jasonrudolph.com> * Clarifying that closing PRs doesn't automatically open new PRs, only on new updates * Update content/github/administering-a-repository/configuration-options-for-dependency-updates.md Co-authored-by: hubwriter <hubwriter@github.com> * Want to give the more descriptive 'Frequency of Dependabot PRs' title, as it's the section title Co-authored-by: Jason Rudolph <jason@jasonrudolph.com> Co-authored-by: hubwriter <hubwriter@github.com>
1 parent 5be5522 commit 6a3447c

2 files changed

Lines changed: 11 additions & 3 deletions

File tree

content/github/administering-a-repository/configuration-options-for-dependency-updates.md

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,12 @@ updates:
147147
interval: "weekly"
148148
```
149149

150+
{% note %}
151+
152+
**Note**: `schedule` defines when {% data variables.product.prodname_dependabot %} attempts a new update. However, it's not the only time you may receive pull requests. Updates can be triggered based on changes to your `dependabot.yml` file, changes to your manifest file(s) after a failed update, or {% data variables.product.prodname_dependabot_security_updates %}. For more information, see "[Frequency of {% data variables.product.prodname_dependabot %} pull requests](/github/administering-a-repository/about-dependabot-version-updates#frequency-of-dependabot-pull-requests)" and "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)."
153+
154+
{% endnote %}
155+
150156
### `allow`
151157

152158
{% data reusables.dependabot.default-dependencies-allow-ignore %}
@@ -358,7 +364,7 @@ updates:
358364

359365
### `open-pull-requests-limit`
360366

361-
By default, {% data variables.product.prodname_dependabot %} opens a maximum of five pull requests for version updates. Once there are five open pull requests, new requests are blocked until you merge or close some of the open requests. Use `open-pull-requests-limit` to change this limit. This also provides a simple way to temporarily disable version updates for a package manager.
367+
By default, {% data variables.product.prodname_dependabot %} opens a maximum of five pull requests for version updates. Once there are five open pull requests, new requests are blocked until you merge or close some of the open requests, after which new pull requests can be opened on subsequent updates. Use `open-pull-requests-limit` to change this limit. This also provides a simple way to temporarily disable version updates for a package manager.
362368

363369
This option has no impact on security updates, which have a separate, internal limit of ten open pull requests.
364370

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1-
When you first enable version updates, you may have many dependencies that are outdated and some may be many versions behind the latest version. {% data variables.product.prodname_dependabot %} checks for outdated dependencies as soon as it's enabled. You may see new pull requests for version updates within minutes of adding the configuration file, depending on the number of manifest files for which you configure updates.
1+
When you first enable version updates, you may have many dependencies that are outdated and some may be many versions behind the latest version. {% data variables.product.prodname_dependabot %} checks for outdated dependencies as soon as it's enabled. You may see new pull requests for version updates within minutes of adding the configuration file, depending on the number of manifest files for which you configure updates. {% data variables.product.prodname_dependabot %} will also run an update on subsequent changes to the configuration file.
22

3-
To keep pull requests manageable and easy to review, {% data variables.product.prodname_dependabot %} raises a maximum of five pull requests to start bringing dependencies up to the latest version. If you merge some of these first pull requests before the next scheduled update, then further pull requests are opened up to a maximum of five (you can change this limit).
3+
{% data variables.product.prodname_dependabot %} may also create pull requests when you change a manifest file after an update has failed. This is because changes to a manifest, such as removing the dependency that caused the update to fail, may cause the newly triggered update to succeed.
4+
5+
To keep pull requests manageable and easy to review, {% data variables.product.prodname_dependabot %} raises a maximum of five pull requests to start bringing dependencies up to the latest version. If you merge some of these first pull requests before the next scheduled update, remaining pull requests will be opened on the next update, up to that maximum. You can change the maximum number of open pull requests by setting the [`open-pull-requests-limit` configuration option](/github/administering-a-repository/configuration-options-for-dependency-updates#open-pull-requests-limit).

0 commit comments

Comments
 (0)