Summary

Today, Dependabot security updates always send one PR per package updated. So, if you have a security update that affects JUnit, and you have 5 pom.xml files that each list JUnit as a dependency, you'll get 5 pull requests. With this change, we'll instead send one secuirty update PR for all instances of a vulnerable package in a single repository.

Intended Outcome

Reduce the volume of Dependabot PRs a user needs to review to address a single vulnerability.

How will it work?

For a new vulnerability, instead of sending one PR per dependency, Dependabot will send one PR per repo.