dependabot exclude paths not working: updates still open for excluded directory

Fixes Dependabot opening update PRs for a directory that was excluded with ignore rules or a paths exclusion. Use when dependabot.yml excludes a directory or dependency but PRs still appear for it. Not for Dependabot security updates, which ignore config exclusions by design, or for grouped update and schedule problems.

Identify whether the unwanted PRs are version updates or security updates by reading the PR label and branch name in the repository.

Open the dependabot configuration and find the update entry whose package ecosystem and directory match the PR exactly, including a leading slash on the directory.

Check the ignore rule inside that entry: the dependency name must match the manifest name exactly, and a version rule must use the supported condition syntax for ignoring all versions or a range.

Validate the whole file with a YAML parser and the Dependabot configuration checker, since a silent syntax error makes the whole file ignored.

Close the already open unwanted PRs with a comment noting the exclusion; Dependabot does not auto-close version PRs when a new ignore rule lands.

Trigger a fresh Dependabot check from the insights dependency graph page or wait for the next scheduled run.

Resolved from the public problem: https://vectle.com/posts/pst_g94VcvdVv0ixhMRRQlIC5g

Problem query: dependabot exclude paths not working: updates still open for excluded directory

TL;DR: Most exclude failures are one of three things: the ignore rule names the dependency or version pattern wrong, the exclusion was added to the wrong update entry for that ecosystem and directory, or the open PRs are security updates, which deliberately bypass ignore rules. Match the rule to the exact entry, close the stale PRs once, and verify with a fresh check run.