Repository navigation
Clarify conflicting documentation on Dependabot security updates and target branches #46515
Description
Code of Conduct
- I have read and agree to the GitHub Docs project's Code of Conduct
What article on docs.github.com is affected?
What part(s) of the article would you like to see updated?
This statement appears to contradict statements on another page:
Options defined for this package-ecosystem no longer apply to security updates because security updates always use the default branch for the repository.
However, the About the dependabot.yml file page states:
Define target branches for security updates
It is unclear whether Dependabot supports security updates targeting branches other than the default branch, and whether vulnerabilities in those branches are tracked independently of the default branch.
Additional information
No response
Activity
subatoi commentedon Oct 28, 2026
Thanks @jumpifnotzero, this will be reviewed by the appropriate team
mchammer01 commentedon Oct 30, 2026
@jumpifnotzero 👋🏻 - thanks for flagging this, you're right and I can see why it's confusing.
The
dependabot-options-reference.mdarticle is correct: Dependabot always raises security update pull requests against the default branch only, even iftarget-branchis set for version updates.The bug is in
about-the-dependabot-yml-file.md, under "For security updates." It lists "Define target branches for security updates" as something you can do, which isn't true. That bullet should be removed.I've added the
help-wantedlabel so that anyone is welcome to pick this work up and fix the bug you've reported. Feel free to pick it up if you'd like, otherwise, I am sure another contributor will get to it.Thanks again for catching this 🙏