Dependabot Fatigue
ELI5 — The Vibe Check
Dependabot fatigue is opening your PR list and seeing 47 dependency-update PRs from a bot that never sleeps. You start reflexively merging without reading. Eventually, Dependabot bumps something that breaks production and you realize you should have paid attention.
Real Talk
Dependabot fatigue is the desensitization that occurs when automated dependency-update PRs overwhelm a team's review bandwidth. Teams often respond with auto-merge for patch updates, grouped updates, and scheduled update windows. Without guardrails, Dependabot fatigue leads to both missed security fixes and accidentally merged breaking changes.
When You'll Hear This
"Enable grouped updates — we're drowning in Dependabot fatigue." / "That vuln sat in the queue for 3 weeks because of Dependabot fatigue."
Related Terms
Bot PR
A bot PR is a pull request opened by an automated system — Dependabot, Renovate, an AI agent — instead of a human. Some are essential (security patches).
Dependabot
Dependabot is GitHub's robot that checks your dependencies for updates and security vulnerabilities, then opens PRs to fix them.
PR Fatigue
PR fatigue is when your review queue has 40 open PRs and you've stopped actually reading them. You just scroll, click approve, and move on.
Renovate
Renovate is Dependabot's more powerful cousin.