Oh, but I am going to defend Dependabot. It’s not there to secure your app. It’s there so your smallcorp team can get one or two PRs a day against your codebas

Oh, but I am going to defend Dependabot. It’s not there to secure your app. It’s there so your smallcorp team can get one or two PRs a day against your codebases, updating your software dependencies one at a time — rather than an unmanageable mess or slow rot on old systems. That’s literally the original design goal. Any security implications are indirect.