GitHub · Pull requests · Dependabot · Checked October 27, 2026

GitHub: Dependabot does not rebase its pull request

By default, Dependabot automatically rebases its pull requests to resolve any conflicts. It stops rebasing a pull request once extra commits have been pushed to it, and one that has not been merged for 30 days; you can still rebase and merge it yourself, or ask Dependabot with a comment (GitHub's managing pull requests for dependency updates, checked October 27, 2026).

@dependabot rebase
@dependabot recreate

Why Dependabot stopped rebasing

Extra commits: by default Dependabot stops rebasing a pull request once extra commits have been pushed to it. Update branch is one way they get there: it merges the head of the base branch into the pull request branch (GitHub's update a pull request branch). Conflicts resolved by hand and pushed are another.
30 days: Dependabot stops rebasing a pull request that has not been merged for 30 days.
The setting: with rebase-strategy: disabled in dependabot.yml, Dependabot stops rebasing its pull requests. Those open before you disabled it are still rebased until 30 days after they were opened (GitHub's Dependabot options reference).
When it looks: Dependabot checks for changes when the schedule for version updates runs, when you reopen a closed Dependabot pull request, when you change target-branch, and when a Dependabot pull request is in conflict after a recent push to the target branch.

The comment commands

@dependabot rebase: rebases the pull request. Dependabot reacts with a thumbs up to acknowledge a command and may reply with a comment; when it is busy with other updates or commands, a command can take several minutes (GitHub's Dependabot pull request comment commands).
@dependabot recreate: recreates the pull request, overwriting any edits that have been made to it.
Letting it force push: a commit whose message contains [dependabot skip], [skip dependabot], [dependabot-skip] or [skip-dependabot], in lower or uppercase, does not stop Dependabot: it may rebase and force push over it.
Ignoring closes it: @dependabot ignore this dependency, and the major, minor and patch version variants, close the pull request and store the preference for the repository centrally; with more than one contributor, GitHub suggests the ignore option in the configuration file instead.

Other Dependabot pull request errors

Already applied: Dependabot closes its pull request once the update has been committed to the default branch, but in rare cases it stays open. @dependabot recreate or @dependabot rebase makes Dependabot check, and close it when it is no longer required (GitHub's Dependabot errors).
An open pull request for the latest version: for a security update, Dependabot does not open a second pull request for a dependency that already has one open to its latest version. Merge that one when it is safe, or close it and trigger a new one.
The limit: "Dependabot cannot open any more pull requests" when 10 security update or 5 version update pull requests are open (the second is open-pull-requests-limit). Merge or close some, then trigger a new one.
Triggering one: for a security update, open the Dependabot alert and click Create Dependabot security update; for version updates, go to Insights, Dependency graph, the Dependabot tab, click Last checked TIME ago, then Check for updates.

What to do

Behind or in conflict: comment @dependabot rebase rather than updating the branch or resolving the conflicts yourself, which adds the commits that stop Dependabot. For other pull requests, see merge conflicts and updating the branch.
Someone already pushed to it: @dependabot recreate starts it over without those edits, or rebase and merge it yourself.
Keeping it rebased: leave rebase-strategy at its default, and merge Dependabot pull requests within 30 days.

GitHub pull requests in IntelliJ IDEA

Pull Request Inbox for GitHub, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, shows a pull request's reviews, checks and conversations next to the diff, and merges it with the methods the target branch allows. On a pull request Dependabot opened, its merge checks say to comment @dependabot rebase when the target branch has new commits or the two conflict, and it does not offer Update the branch there; its comment box sends the command from the IDE. The review inbox, diffs and conversations are free; approving, commenting, resolving and merging are Pro (US$1.50 a month, with a 30-day trial).

GitHub is a trademark of GitHub, Inc.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with or endorsed by GitHub, Inc. or JetBrains.