Dependabot PRs now require approval to run

[ReenigneArcher]

In the last 24 hours, it seems there has been a change to how dependabot PRs are treated.

I have always had "Require approval for all external contributors" enabled, but never had to approve dependabot PRs.

Is this change intentional, or was this an anomaly? This will greatly disrupt my workflow. I intentiionally set dependabot to run in the middle of the night, so that the workflows are complete when I start my day.

[mg1986jp]

This is a GitHub security feature, not a Dependabot issue. For public repos with fork-based PRs, GitHub requires approval for first-time contributors before running workflows. Dependabot PRs can sometimes trigger this if the repo has certain branch protection rules.

To fix it:

1. Go to your repo → Settings → Actions → General
2. Under "Fork pull request workflows from outside collaborators", select "Approve and run" for the policy you want
3. Or under "Workflow permissions", make sure Dependabot has the right access

If this is a private repo, check your branch protection rules — "Require approval" might be enabled for all PRs, including automated ones. You can add Dependabot to a bypass list if your plan supports it.

Also check if you have pull_request_target or pull_request triggers in your workflows — the approval requirement depends on which trigger is used.

[ReenigneArcher]

I'll chop this up to GitHub breaking stuff every day, haven't seen it in a while.