Dependabot keeps creating PRs even when disabled and commented out

[jsattler]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

maven

Package manager version

No response

Language version

No response

Manifest location and content before the Dependabot update

No response

dependabot.yml content

# version: 2
# updates:
#   - package-ecosystem: "maven"
#     directory: "/services"
#     schedule:
#       interval: daily

Updated dependency

No response

What you expected to see, versus what you actually saw

I expect that when I comment out the dependabot.yml and disable dependabot in the organization settings, that no further pull requests will be created. However, dependabot still creates pull requests.

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

No response

Smallest manifest that reproduces the issue

No response

[yeikel]

I am not sure if comments is a way to disable dependabot

Check out this thread #7072 (comment)

[yeikel]

Actually, the docs state that commenting out should work

by commenting out the relevant package-ecosystem in the configuration file.

Are the upgrades regular dependency or security updates? The security updates can be disabled from the repository settings

[jsattler]

The upgrades are regular dependency upgrades. I disabled every dependabot configuration (including security updates) for that specific repository, but dependabot keeps creating pull requests.