When a dependency matches both an allow rule and an ignore rule, ignore wins in the documentation of one widely used bot. It first filters to dependencies that match your allow rules, then applies ignore rules to what remains. Learn your tool's order before you write rules, because a wrong guess silently hides updates.
What the documentation says
Per the options reference for that bot, dependencies are filtered by allow first. The allow rule can match a dependency name with wildcards, a dependency type (direct, indirect where supported, all, production or development), and update types. If you omit update types in an allow rule, all update types are allowed. Ignore rules then remove matches, and they can target specific levels with values for patch, minor and major version updates. A dependency matched by both is ignored.
Without any allow rule, all explicitly defined dependencies get version updates, and security updates cover vulnerable dependencies in lock files.
A worked example
Say you want updates for production dependencies only, but never major ones for a framework.
| Rule | Effect |
|---|---|
| Allow production dependencies | Development packages get no version updates |
| Ignore the framework, major level | Framework majors are skipped |
| Result | Framework minors and patches still arrive, majors do not |
Now reverse your thinking. If you add an ignore rule for the framework with no update type, the whole framework is ignored, not just majors. That is a common mistake.
Steps to write rules safely
- Start with no rules and watch a full cycle of pull requests.
- Add ignore rules only for specific problems, each with a comment and a revisit date.
- Prefer ignoring a level, such as major, over ignoring a whole package.
- If you use allow rules, list what you want, then check that nothing important is now missing.
- After every rule change, compare the next cycle's pull requests with the previous one.
Why this matters for security
Version update rules and security update behavior are separate in the documentation above, but a sloppy configuration still creates blind spots. A package you ignored for convenience may later carry an advisory. Keep a list of ignored packages and review it on a schedule, so an ignore added for a quiet week does not become permanent.
Same idea, other tools
Other bots have include and exclude style settings, and precedence rules differ. For one documented cooldown setting, the exclude list takes precedence over the include list. Every tool has its own order, so read the section on matching and precedence.
Quick check
Does ignore apply to security updates?
The options documentation we read describes ignore in terms of version updates. Check your tool and test with a known advisory before relying on it.
How do I skip only major updates?
Use an ignore rule scoped to the major update level for that dependency, rather than ignoring the dependency entirely.
Safeguard scans manifests and lockfiles into an SBOM, uses reachability analysis to show which flagged dependencies your code actually calls, and can open fix pull requests (off by default, every category on Manual). You can try a free scan on a public repository.
Sources
Last reviewed: 19 October 2026.
