Microsoft DevOps Engineer Expert AZ-400 Practice Question

The correct configuration uses open-pull-requests-limit: 0 for the 'npm' package ecosystem. According to GitHub's documentation, Dependabot security updates and version updates are distinct features. The open-pull-requests-limit option specifically controls the number of open pull requests for version updates. Setting this limit to 0 effectively disables version updates, while security updates, which are not subject to this limit, will continue to be created whenever a vulnerability is detected. This directly addresses the requirement to stop noise from version updates while retaining automated security patching. The option to use update-types: ["security"] is incorrect because 'security' is not a valid value for this option. Using an ignore rule for patch updates would only be a partial solution, as it would not stop minor and major version updates. Disabling Dependabot entirely in favor of npm audit is a different workflow and does not use the dependabot.yml file to solve the problem as requested.