repo sync

content/code-security/supply-chain-security/understanding-your-software-supply-chain/troubleshooting-the-dependency-graph.md

@@ -48,7 +48,18 @@ Yes, the dependency graph has two categories of limits:
 
     Manifests over 0.5 MB in size are only processed for enterprise accounts. For other accounts, manifests over 0.5 MB are ignored and will not create {% data variables.product.prodname_dependabot_alerts %}.
 
-    By default, {% data variables.product.prodname_dotcom %} will not process more than {% ifversion fpt %}150{% else %}600{% endif %} manifests per repository. {% data variables.product.prodname_dependabot_alerts %} are not created for manifests beyond this limit. If you need to increase the limit, contact {% data variables.contact.contact_support %}. 
+    By default, {% data variables.product.prodname_dotcom %} will not process more than {% ifversion fpt %}150{% else %}600{% endif %} manifests per repository. {% data variables.product.prodname_dependabot_alerts %} are not created for manifests beyond this limit. If you need to increase the limit, contact {% data variables.contact.contact_support %}.
+
+    Manifest files stored in directories with names that are typically used for vendored dependencies will not be processed. A directory whose name matches the following regular expressions is considered a vendored dependencies directory:
+      - <code>(3rd|[Tt]hird)[-_]?[Pp]arty/</code>
+      - <code>(^|/)vendors?/</code>
+      - <code>^|/)[Ee]xtern(als?)?/</code>
+      - <code>(^|/)[Vv]+endor/</code>
+
+      Examples: 
+      - third-party/dependencies/dependency1
+      - vendors/dependency1
+      - /externals/vendor1/dependency1
 
 2. **Visualization limits**