Brief
GitHub's Dependabot backlog: a queue flooded by its own fan-out
On 23 October a fan-out of Dependabot alert events flooded a shared queue and delayed push events. GitHub isolated it and throttled it.
By Mira Vance
Published 26 October 2026
Drafted with AI assistance, researched, verified and edited by the HastCode editorial team. We publish only as many pieces as the Author can verify this way.
What happened
On 23 October, Dependabot alerts on GitHub were slow to close after repositories were updated. GitHub's incident report says "an advisory-publication driven fan-out was overwhelming Dependabot alert processing on repositories by saturating the queue with its own events". Updates from 15:39 to 16:43 UTC describe more processing capacity rolling out; the final update credits isolating the fan-out and a throttle "so it runs at a fixed rate and cannot delay other events".
Why it matters
One job's events shared a queue with everyone else's, so a burst from one producer delayed unrelated work. The durable fix was not more consumers but a separate lane with a fixed rate. We infer from the timeline that capacity alone did not clear the backlog quickly; the report does not say so directly. It is the same lesson as metastable failures: when load feeds on itself, remove the extra load, then recover.
Source: githubstatus.com
Get new Explainers by email
How real systems are built, in your inbox. No spam; unsubscribe any time.