Why can not automatically only trigger dependabot security updates with specific dependabot.yaml file

[yyashYin]

Select Topic Area

Product Feedback

Body

example dependabot.yaml

version: 2
updates:
  - package-ecosystem: "gomod"
    directory: "/"
    schedule:
      interval: "daily"
      time: "05:25"
      timezone: "America/Chicago"
    open-pull-requests-limit: 0
    labels:
      - "testing"

but I check it after the schedule time 05:30 timezone:America/Chicago, the PR can not be updated with new label testing, but when I use manually trigger create security updates via dependabot alerts, it works, the new PR is created. Does anyone know it?