How do I stop dependency update pull requests flooding many services?

Group related updates into fewer pull requests, cap how many can be open at once, and set a sensible schedule. In Dependabot, the groups, open-pull-requests-limit and schedule interval options do this. The goal is a steady trickle that teams can review, not a daily flood that gets ignored.

What the options do

GitHub's Dependabot reference describes these behaviours.

• groups: combine updates into fewer pull requests. Matching dependencies go into one pull request, and a dependency matching more than one rule goes into the first group it matches. By default, each outdated dependency gets its own pull request.
• schedule.interval: required for each package ecosystem entry, with values such as daily, weekly, monthly, quarterly, semiannually, yearly or cron.
• open-pull-requests-limit: the maximum number of version update pull requests open at once. The default is five. Security update pull requests have a separate fixed limit of ten, which you cannot configure with this option.

Monorepos and many directories

For a repository with many services, directories accepts a list of directories and supports globbing and the star wildcard, while directory takes a single one. To group updates across several directories, groups with group-by set to dependency-name applies to version updates only, and all the directories must use the same package ecosystem.

That last restriction matters. A monorepo with Node and Python services needs separate entries for each ecosystem.

A small example

version: 2
updates:
  - package-ecosystem: "npm"
    directories:
      - "/services/*"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 5
    groups:
      minor-and-patch:
        update-types:
          - "minor"
          - "patch"

Check the reference for the exact keys available in your version, since options evolve.

Policy choices

1. Group minor and patch updates, and leave majors ungrouped so they get a human look.
2. Keep security updates fast. Do not let a grouping rule delay an urgent fix.
3. Pick weekly for most services, and daily only for tier 1.
4. Set the cap low enough that reviewers keep up.

Measure it

Track the median age of open update pull requests and the share merged within a week. If the age grows, lower the cap or increase grouping. If the share merged is low, the updates may be too large or tests too slow to trust.

Quick check

Try it yourself

Click through it at your own pace, or open it full screen. Look at how a fix is proposed for a known vulnerable dependency.

Safeguard can open fix pull requests with autonomous remediation, which is off by default with every category on Manual, and a free scan shows the findings first.

Sources

• GitHub Dependabot options reference

Last reviewed: 19 October 2026.