How do I ignore one dependency, disable version updates, and still keep Dependabot security updates working?

[Derek777-dev]

🏷️ Discussion Type

Question

Body

What I want is:

a private registry for npm
to ignore all updates for lodash
to disable normal version update PRs
to still group Go security updates by package name

I am not fully sure about the best way to structure the config.
What is the correct Dependabot setup for this?

Guidelines

• I have read and understood this category's guidelines before making this post.

[MoemenSuper]

Use ignore for lodash, open-pull-requests-limit: 0 to stop version update PRs, and a groups rule with applies-to: security-updates for the Go dependencies. Also make sure the registry name under updates.registries matches the registry you defined in the top-level registries section.