A #githubfail for @wezm—if you've turned off PRs for a repo, when you get a dependabot notification it just 404s, since it can't open a PR. There's a perfectly good security tab it could link to.
I click the Commits tab on a PR. The blue pjax loading bar starts its slow, erratic crawl across the top of the page. It gets closer and closer to the end, the page remaining unchanged the whole time. It reaches the end. Nothing happens. No errors in the console, no error in the UI, it just didn't work. I click again, there's some requests in the Network tab, but the page remains steadfastly attached to the Conversation view. I press F5, and the commits view finally loads.

