This is absolutely it. For JS we only use it for security fixes now on my team because it was creating too much work otherwise. My personal blog is Gatsby (a de

This is absolutely it. For JS we only use it for security fixes now on my team because it was creating too much work otherwise. My personal blog is Gatsby (a decision I now regret somewhat), and gets a couple of Dependabot PRs a day which is ridiculous.