Enable dependabot for all security updates but limit regular updates

[toby-lego]

We have been using dependabot but found that it is too noisy for the npm ecosystem with lots of minor and patch versions we don't care about.

We would like to retain the security alert PRs, as well as tracking a few major dependencies we are interested in.

Following the guidance to use "open-pull-requests-limit" to enable only security updates, I attempted something like this:

updates:
  - package-ecosystem: "npm"
    directory: "/"
    registries: "*"
    schedule:
      interval: "daily"
    # this disables regular updates, security updates will still get PRs
    open-pull-requests-limit: 0

  - package-ecosystem: "npm"
    directory: "/"
    registries: "*"
    schedule:
      interval: "weekly"
      day: "wednesday"
    allow:
      - dependency-name: "prisma"

But I run into this problem: The property '#/updates/1' is a duplicate. Update configs must have a unique combination of 'package-ecosystem', 'directory', and 'target-branch'

Is there a way to have security updates apply for all packages, but regular updates only for our "allowed" dependencies?

[David-Mueller]

Did you try to set the target-branch property to make sure both configs are unique?
target-branch: develop