Previously the npm entries carried only open-pull-requests-limit: 0, which bounds version updates and leaves security updates unlimited, so npm pull requests kept arriving from Dependabot alerts. The ignore option applies to both kinds, so a blanket ignore per npm entry is what actually stops them. Go modules and GitHub Actions updates are unchanged.