How do you edit a bot's fix PR without the bot overwriting you?

You can edit a bot's fix PR safely if you tell the bot to back off. Dependabot stops rebasing once extra commits are pushed, and a skip marker in the commit message lets you override that. Renovate lets you add a label that makes it stop updating the PR.

The situation

A fix PR is almost right. Perhaps a test needs a one line change for the new version. You push a commit to the bot's branch. Then the bot rebases, or force pushes, and your commit vanishes. Knowing each tool's rule saves an afternoon.

Dependabot

GitHub's documentation says that by default Dependabot automatically rebases pull requests to resolve conflicts. It also says Dependabot will stop rebasing a PR once extra commits have been pushed to it. So a plain extra commit usually freezes the branch, which is what you want when editing.

If you want the opposite, Dependabot allows you to let it force push over commits added to its branches. To do that, include one of these strings in the commit message, in lower or upper case: dependabot skip in square brackets, skip dependabot in square brackets, or the hyphenated forms. The exact spellings are in the GitHub documentation, so copy them from there rather than from memory.

Two other facts matter. If a PR has not been merged for 30 days, Dependabot stops rebasing it anyway. And you can disable automatic rebasing for a whole configuration with the rebase-strategy option, although PRs opened before you disable it keep being rebased until 30 days after they were opened.

Renovate

Renovate documents a stopUpdatingLabel option. By default it listens for a label named stop-updating on the PR, and when it sees that label it stops updating the PR. You can pick your own label name in configuration. The documentation notes this works only on supported platforms, which include GitHub and GitLab among others.

A safe editing routine

1. Say you are editing. Add the stop label or a PR comment so teammates do not also push.
2. Make the smallest change. Fix the test or the call site, nothing else.
3. Run the full checks. Your edit is now part of the change and needs the same gate.
4. Explain it in the PR. One sentence on why the edit was needed.
5. Merge, then remove the stop label if the tool will keep tracking that package.

When not to edit the bot's branch

If the needed change is large, do not smuggle it into a bot PR. Open a separate PR that prepares the code for the new version, merge it first, and let the bot PR go green on its own. This keeps the history honest: one PR for the code change, one for the version bump. It also helps a reviewer, who can read the code change without a lockfile diff on top. Compare lockfile only fix versus manifest change review.

What to watch for

Mixed human and bot commits blur authorship. If your policy says bot PRs get a lighter review because they are mechanical, a PR with human edits is no longer mechanical. Treat it like a human PR and route it for review accordingly. See give a fix bot its own identity and signed commits for keeping the two apart.

Safeguard can open fix pull requests through autonomous remediation. It is off by default and every category starts on Manual, so a person approves each change. You can also run a free scan to see which dependencies have known fixes before you decide what to automate.

Quick check

Sources

• GitHub Docs: Managing pull requests for dependency updates
• GitHub Docs: Dependabot options reference
• Renovate Docs: Configuration options

Last reviewed: 19 October 2026.