"I enabled Dependabot, but no PR comes at all," "vulnerability alerts appear but no fix PR is created," "a red error keeps appearing on a private registry" — the most common Dependabot consultation is this kind of "doesn't work." Most causes aren't a malfunction but a misunderstanding of configuration, or insufficient isolation.
This article systematizes troubleshooting to reach the cause from the symptom, as a topic of the Dependabot production-operations guide. It's written as a checklist you can confirm in order at hand.
Rules for this article: error names, behavior, and commands are based on the GitHub official documentation (as of June 2026). In particular, the @dependabot comment commands changed on January 27, 2026, so info from old articles is dangerous (below). Always confirm the latest in the official troubleshooting before production operation.
0. First, isolate: which of the "three pillars" is stopped
Dependabot is a collective name for three separate features. Identifying which one isn't working first narrows the cause at once.
症状：新しいバージョンのPRが来ない
→ version updates の問題（.github/dependabot.yml が要る）
症状：脆弱性アラートは出るが修正PRが来ない
→ security updates の問題（パッチの有無・前提条件）
症状：脆弱性アラート自体が出ない
→ alerts / 依存グラフ の問題（設定トグル）
Decide which of these three branches you're in, then proceed to the corresponding chapter.
1. "No PR for a new version comes" (version updates)
1.1 First check .github/dependabot.yml
Version updates don't work without the config file. Check the following in order.
- File path:
.github/dependabot.ymlat the repository root (not.github/workflows/). - YAML indentation: no tabs, 2 spaces. Are
version: 2andupdates:present. - The
package-ecosystemvalue: a correct identifier likenpm/pip/gomod/docker/github-actions.nodeandyarnare wrong (npm/yarn/pnpm are allnpm). directory: does it point to the directory with the manifest (root is/).
1.2 "Pull request limit reached"
The official PR-count limit is version updates = 5 / security updates = 10. When the limit is reached, no new PRs are created.
- Fix: merge or close existing Dependabot PRs to free up slots.
- If review can't keep up, bundle PRs with
groupsand automate patch/minor with auto-merge. Raisingopen-pull-requests-limitis a symptomatic treatment, not a root-cause fix for the noise.
1.3 Other "doesn't come" causes
| Cause | Confirm/fix |
|---|---|
Stopped by ignore | Is there an ignore condition on that dependency? Confirm with @dependabot show <name> ignore conditions (below) |
target-branch is another branch | Is it watching a non-default branch? PRs are created against that branch |
Waiting for schedule | With weekly/monthly, nothing comes until the next run. Confirm with a manual trigger (§5) |
| Already latest | If the dependency is already latest, nothing happens (normal) |
| Lockfile not committed | .gitignore'ing package-lock.json, etc., can prevent resolution |
2. "Vulnerabilities don't get fixed" (security updates / alerts)
2.1 "Cannot update X to a non-vulnerable version"
The most frequent message in security updates. It means "the vulnerability is identified, but it can't be upgraded to a safe version without breaking other dependencies."
- Cause: no fixed version yet, or a version-constraint conflict with another package in the dependency graph.
- Fix: enabling version updates to keep dependencies fresh routinely raises the probability of resolving a vulnerability with a simple upgrade when it counts (the official recommendation). The more pickled the dependency, the more you stall on an urgent vulnerability fix.
2.2 No alert appears at all
| Check item | Fix |
|---|---|
| Is the dependency graph enabled | Turn on Dependency graph in Settings → Advanced Security |
| Are Dependabot alerts enabled | Turn on Dependabot alerts in the same settings |
| Are security updates enabled | Turn on Dependabot security updates in the same settings |
| Is the lockfile committed | Security updates target only dependencies listed in a manifest or lockfile |
| Is it a supported ecosystem | Unsupported languages/managers aren't detected |
The operations design for vulnerability response (SLA, auto-triage, grouped security updates) is detailed in the alerts/security-updates guide.
3. Parsing/resolution errors (dependency files)
3.1 "Dependabot can't resolve your LANGUAGE dependency files"
An error of not being able to resolve the dependency files.
- Cause: a referenced dependency (a local path reference, an unreachable URL, a manifest in another repository, etc.) can't be accessed.
- Fix: confirm all referenced targets are in accessible locations. If referencing a private repo, an organization-level allowance of private-repository access may be needed.
3.2 "the dependency file is not parseable / not found"
- Cause: a syntax error in the manifest/lockfile, or the file isn't in the expected location (a
directorymistake). - Fix: run the package manager locally to confirm the manifest resolves correctly (
npm install/pip install/go mod tidy, etc.). Re-check thedirectorypath.
4. Private-registry errors (four categories)
Errors around internal registries are classified by the official docs into four codes. The cause is known from the symptom, so it's fast to remember.
| Error (code) | Meaning | Main fix |
|---|---|---|
private_source_not_reachable | Can't reach the registry | Network reachability. For a private network not reachable from GitHub-hosted, a self-hosted runner |
private_source_authentication_failure | Authentication failed | Check the registries definition and Dependabot secrets (≠ Actions secrets). Token expired, insufficient scope |
private_source_timed_out | The registry response timed out | Registry load, network delay. Retry, check the route |
private_source_certificate_failure | Can't verify the certificate | Self-signed/internal CA. Check the certificate-chain setting |
How to build the configuration (per-type authentication of registries, OIDC, self-hosted runners) is comprehensively covered in the private-registry authentication guide.
5. How to read logs and the manual trigger (consult the primary source)
Before guessing, look at the primary source.
- Open the repository's Insights → Dependency graph → Dependabot tab.
- Confirm each ecosystem's Last checked (last run) and status.
- If it failed, open the job log and search for the above error strings.
You can also trigger manually to reproduce/confirm immediately.
- Version updates: click "Check for updates" in the Dependabot tab.
- Security updates: click "Create Dependabot security update" on the relevant alert screen.
When "I changed a setting but can't tell if it worked," manual trigger → job log is the shortest verification loop.
6. @dependabot comment commands (mind the January 2026 change)
You can give instructions to an open PR via a comment. This changed on January 27, 2026 — copying old articles grabs commands that don't work, so be careful.
6.1 The update-behavior control commands that "remain"
These control Dependabot's update behavior and remain valid since there's no replacement in GitHub's standard UI.
@dependabot rebase # PR を rebase する
@dependabot recreate # PR を作り直す（手編集は破棄）
@dependabot ignore this dependency # この依存の今後のPRを止める
@dependabot ignore this major version # この major を無視
@dependabot ignore this minor version # この minor を無視
@dependabot ignore this patch version # この patch を無視
@dependabot unignore <dependency> # ignore を解除
@dependabot show <dependency> ignore conditions # 現在の ignore 条件を表示
Increasing
ignorevia comments piles up implicit ignore conditions not written independabot.yml. It's a breeding ground for "updates somehow don't come," so take inventory withshow ... ignore conditionsand state permanent rules on thedependabot.ymlside (ignore-pickling countermeasure).
6.2 The deprecated PR-lifecycle commands (2026-01-27)
The PR-lifecycle operations @dependabot merge / squash and merge / cancel merge / close / reopen, etc., were deprecated. GitHub recommends doing them with the standard PR features.
| What you want to do | The way going forward |
|---|---|
| Merge | GitHub's Merge button / gh pr merge / auto-merge workflow |
| Close / reopen | GitHub's standard UI / gh pr close · gh pr reopen / REST API |
An example using the gh CLI:
gh pr merge <PR番号> --squash # マージ（自動化は auto-merge ワークフローで）
gh pr close <PR番号> # クローズ
6.3 Other tips
- To skip a force-push (don't let Dependabot overwrite your edits): include
[dependabot skip](or[skip dependabot]/[dependabot-skip]/[skip-dependabot]) in the commit message. - The 30-day rule: for a PR not merged within 30 days, Dependabot stops auto-rebasing. Manually rebase/recreate an old PR.
7. A checklist to prevent stalls
- The path/indentation/
package-ecosystem/directoryof.github/dependabot.ymlare correct - The manifest and lockfile are committed (not
.gitignore'd) - alerts / security updates / dependency graph are all ON
- On reaching
open-pull-requests-limit, cycle slots with groups and auto-merge - Private registries with registries + Dependabot secrets + a self-hosted runner
- Periodically inventory the
ignoreincreased via comments (show ... ignore conditions) - Unify PR operations to the standard UI /
ghCLI / auto-merge (don't use deprecated commands)