Dependabot is sometimes enabled on forks

[evverx]

According to https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates#enabling-version-updates-on-forks

Version updates are not automatically enabled on forks when a dependabot.yml configuration file is present. This ensures that fork owners don't unintentionally enable version updates when they pull changes including a dependabot.yml configuration file from the original repository

but according to dependabot/dependabot-core#2804 (comment)

Dependabot version updates (setup from config file) isn't enabled by default on new forks but will be if security updates has ever been turned on and since disabled.

which means that apparently in some cases forks will receive PRs from Dependabot and the only workaround is

The workaround for now is to delete the fork and re-create it without enabling Dependabot security updates

I don't think it affects a lot of forks but to be sure it would be great if all issues related to PRs from Dependabot could be discussed here.

To somewhat mitigate the issue the number of PRs Dependabot can create will be limited: #21342

[mrc0mmand]

Relevant upstream issues:

• .dependabot/config.yml and forks dependabot/dependabot-core#2198
• How to disable for a fork? dependabot/dependabot-core#2804

[eworm-de]

This one is really annoying... As the upstream issues are open for a long time already I guess this will not be fixed any time soon. 😒
So time to delete and recreate my fork?

[evverx]

So time to delete and recreate my fork?

Unfortunately, it seems to be the only way to get rid of those PRs

I'm not sure why it opened eworm-de#4 and eworm-de#5 though. Both those updates were blocked in #21505 and #21574.

[evverx]

I'm not sure if it helps but all those PRs are also auto-closed once forks get updated so in principle if PRs like eworm-de#4 were blocked explicitly by using something like https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates#ignore in the systemd repository most forks updated at least once a week would never get Dependabot PRs.

[evverx]

Judging by https://github.blog/changelog/2022-11-07-dependabot-pull-requests-off-by-default-for-forks/ it was fixed