dependabot-config

Overview

Per db-cfg, Dependabot opens PRs (or issues, for security-only updates) when a new version is available for a declared dependency, configured via .github/dependabot.yml at the repo root.

This is a reference skill - it defines the config surface; it doesn't run scans (that's snyk-test or osv-scanner). Dependabot complements SCA tools by automating the upgrade PR.

When to use