Confusion about `dependabot.yml` and security updates

[yeikel]

Code of Conduct

• I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#commit-message--
https://docs.github.com/en/code-security/concepts/supply-chain-security/about-dependabot-security-updates

What part(s) of the article would you like to see updated?

As per https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#commit-message--:

For security updates: All commit messages follow the defined pattern, unless target-branch defines updates to a non-default branch.

However, this other page: https://docs.github.com/en/code-security/concepts/supply-chain-security/about-dependabot-security-updates

Suggests that

There is no interaction between the settings specified in the dependabot.yml file and Dependabot security alerts,```

This seems unclear. One source states that commit messages for security updates follow a defined pattern unless updates target a non-default branch. The other source says Dependabot security updates are not affected by settings in `dependabot.yml`, except for alert closure when related pull requests are merged. 

[yeikel]

Closing because I confused security alerts with security updates