Dependabot is creating PRs?

[rfalanga]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Other

Discussion Details

I'm sorry to select Other for the topic for this question, but I really don't know what topic/category this question should go to.

Tonight I thought I'd spend some time deleting repos that I've not used it years. I had 131 repos and just felt that was too many. So, I spent time reviewing and blowing away repos that I felt I could get rid of. The repos I got rid of were all cloned from GitHub Skills.

But I discovered something in 6 of the repos I reviewed. 5 of them had a PR waiting since 2024 or 2025, all related to upgrading the use of actions/checkout from version 4 to version 6, and all created by Dependabot. First, I didn't even know that Dependabot would do that. A fifth repo also had a PR created by Dependabot, but created 4 years ago. I know for a fact that I didn't even know what Dependabot was back then.

What's going on? Why is Dependabot creating all these PRs? And they sit around for years. What does it cost to have Dependabot do this for me? Is it doing this for everyone on GitHub? Is it doing this for all repos in Enterprise Organizations?

[nirav-gajera]

@rfalanga
What you're seeing is normal behavior, and it's usually caused by Dependabot version updates being enabled for those repositories.

A few things are happening here:

• Dependabot doesn't only update dependencies in your code. It can also update GitHub Actions used in your workflows, such as actions/checkout. When a new major version is available, Dependabot can automatically open a pull request suggesting the upgrade.

• Why did it happen if you don't remember enabling it? There are a few possibilities:

  • The repository already had a .github/dependabot.yml configuration file.
  • GitHub Skills template repositories may have included Dependabot or security features by default.
  • GitHub has gradually enabled more automated security and dependency features over the years, especially for public repositories.

• Why did the PRs sit there for years? Dependabot only creates the PR—it doesn't merge or close it unless you have additional automation configured (such as auto-merge). If you never reviewed the repository, the PR simply remained open.

• Does it cost anything? For most personal repositories (especially public ones), Dependabot alerts and security/version updates are included at no additional cost. On GitHub Enterprise, administrators can control which Dependabot features are enabled across repositories, but there's generally no separate per-PR charge for Dependabot itself.

• Is it enabled for everyone? No. It depends on the repository's settings and configuration. Some repositories have:

  • Security updates only
  • Version updates
  • Both
  • Neither

So it's completely possible for some of your repositories to receive Dependabot PRs while others never do.

In your case, the actions/checkout upgrade PRs are exactly what I'd expect if those repositories had Dependabot version updates configured. Since they were old GitHub Skills repositories that you no longer needed, deleting them was perfectly reasonable if you weren't planning to maintain them.

[Exhorder1]

@rfalanga

[LuShadowX]

It isn't happening to everyone, and it isn't a default — a repo only gets these PRs if it contains a .github/dependabot.yml. From About Dependabot version updates: "You must check a dependabot.yml configuration file into your repository to enable version updates."

One of your repos still has open ones, and it has that file — 208 bytes:

# rfalanga/BethanysPieShopHRM — .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "nuget"
    directory: "/"
    schedule:
      interval: "weekly"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

The github-actions block is what produces the actions/checkout PRs. And this is probably the part you're after — you didn't add it:

gh api '/repos/rfalanga/BethanysPieShopHRM/commits?path=.github/dependabot.yml' \
  --jq '.[] | "\(.commit.author.date[0:10])  \(.commit.author.name)  \(.commit.message)"'

2026-03-11  copilot-swe-agent[bot]  Add .github/dependabot.yml to enable Dependabot

A Copilot coding agent session committed it. That explains this repo, at least. The 2024/2025 ones you deleted I can't check any more, but the mechanism is the same — something put that file in the repo, and from then on Dependabot checked weekly.

What it costs: nothing. From the Actions billing docs, under "Free use of GitHub Actions" — "The use of standard GitHub-hosted runners is free: in public repositories, for GitHub Pages, for Dependabot." It doesn't touch your minutes.

Why they sat for years: the same docs note that "when maintainers of a repository stop interacting with Dependabot pull requests, Dependabot temporarily pauses its updates." So an ignored PR goes quiet rather than piling up more.

Worth separating two things people often merge:

• Version updates — the ones you're seeing. Config file required, they bump dependencies whether or not anything is wrong.
• Security updates — only fire when a dependency has a known vulnerability. Different feature, different trigger.

To stop it in a repo, delete or trim .github/dependabot.yml. Removing the github-actions block alone keeps NuGet updates and drops the workflow ones.

For reference, your two currently open PRs are actions/checkout 6 → 7 and actions/setup-dotnet 5 → 6. actions/checkout is genuinely on v7.0.1 now, so those bumps are real and current, not leftovers.

[rfalanga]

WOW! I did not know that .github/dependabot.yml file was there! I didn't put it there. And I followed a Pluralsight course. Interesting, something must have put that YAML file there.

[LuShadowX]

Found it — it was rfalanga/BethanysPieShopHRM#4, "Enable Dependabot for dependency and Actions version tracking", opened by Copilot and merged on 11 March 2026. The commit is co-authored by you:

9f06575  Add .github/dependabot.yml to enable Dependabot
         Co-authored-by: rfalanga <11872620+rfalanga@users.noreply.github.com>

So it came from a Copilot coding agent session you merged, not from the Pluralsight course. Same check works on any repo:

gh api '/repos/OWNER/REPO/commits?path=.github/dependabot.yml' \
  --jq '.[] | "\(.commit.author.date[0:10])  \(.commit.author.name)  \(.commit.message)"'

[jasonmiller2332]

Dependabot is probably enabled in those repos (often via the template or a dependabot.yml file), so it automatically opens PRs for dependency updates like actions/checkout. There's no extra cost for using it on GitHub, and old PRs will stay open until you merge or close them. It's not enabled for every repo by default—repo or organization settings control it.