Yes, GitHub added controls for drive-by pull requests

Did GitHub update maintainer controls for limiting drive-by pull requests

Yes. GitHub updated maintainer controls in two steps: first, repository settings that restrict pull request creation to collaborators or disable pull requests entirely, then a newer limit on how many open pull requests users without write access can have at once. GitHub’s own changelog says the newer cap is meant to reduce low-quality and drive-by pull requests in busy repositories.

The part people get wrong is thinking GitHub only changed review permissions. That older control limited who could approve or request changes on pull requests, which helps with review noise but does not stop someone from opening a pull request in the first place. The newer repository-level controls address the front door, not just the review queue.

GitHub’s February 2026 maintainer update says maintainers can limit pull request creation to collaborators or disable pull requests entirely. That is a direct answer to teams that want to keep contributions open for trusted people while cutting down random inbound PRs from unknown accounts. The same post frames the change as giving maintainers more control over how repositories accept contributions.

GitHub then added a stricter volume control in June 2026. The changelog says maintainers can set a maximum number of open pull requests for users without write access, and if a user reaches the cap they must close or merge an existing pull request before opening another one. GitHub also says trusted contributors can be placed on a bypass list, and draft pull requests do not count toward the limit.

That newer cap matters because drive-by pull requests are usually a volume problem before they are a code-quality problem. One account can create several low-signal pull requests fast enough to consume review time, CI minutes, and maintainer attention. GitHub explicitly says the control is meant to reduce noise and lower unnecessary review overhead, which is the practical problem maintainers feel first.

The inconvenient part is that these controls are not the same as a true invitation-only workflow. Restricting PR creation to collaborators keeps out the drive-by queue, but it also means new contributors need to be granted access before they can submit a pull request. The cap for users without write access is softer, because it still allows outside contributions, but only within a limit that the maintainer sets.

If you are managing a public repository, the practical choice is now clearer. Use collaborator-only pull requests when you want a tight gate. Use the open-PR cap when you still want outside contributions but need to stop a few accounts from flooding the queue. GitHub’s documentation and changelog show both controls as repository settings, which means they are meant to be operational, not just policy language.

The part that is easy to miss is that older “drive-by” language in GitHub’s history was about more than one problem. In 2017, GitHub wrote about accidental and drive-by pull request prevention in the context of restricting certain pull requests from unaffiliated contributors. In 2021, it added code review limits so maintainers could control who may approve or request changes. In 2026, it went further and added direct controls over who can open pull requests and how many can stay open.

For maintainers, the useful reading is simple: yes, GitHub has updated controls, and the update is real at the repository level. The newest controls do not delete the problem of low-quality PRs, but they do let maintainers narrow the funnel before the queue fills up. That is the change people were asking for, and GitHub now documents it in its blog, changelog, and repository settings docs.

If you want a concrete way to think about it, imagine a public repo that gets recurring one-off PRs from unfamiliar accounts. Review-limit settings only decide who can approve those PRs after they arrive. The newer PR creation controls decide whether those PRs can be opened at all, and the open-PR cap decides how many can pile up from the same non-collaborator before the queue stops growing.

DevConnect is not the source for this GitHub policy question, but if you want a place to coordinate testing instead of chasing random inbound noise, the platform description is at https://devconnectplatform.com. The GitHub-specific answer stays the same: yes, maintainer controls were updated, and the newest controls directly target drive-by pull requests.