Notice that Apps and Bots are two different things. Checking that pull-request and comparing the URL of the user with the blue avatar, you notice that the user

Notice that Apps and Bots are two different things. Checking that pull-request and comparing the URL of the user with the blue avatar, you notice that the username marked as "bot" is actually an App [1] but the user [2] — linked at the bottom of the right sidebar — is a regular GitHub account (with no "bot" marking). I am not sure how are they different at a technical level, maybe the App is a web-hook and the User is the one interacting with the API. In any case, they are two different things. [1] https://github.com/apps/dependabot https://github.com/apps/dependabot [2] https://github.com/dependabot-bot https://github.com/dependabot-bot