I'd change this issue to a title of "Add Dependabot integration". Where we then just add Dependabot into our GitHub workflow. It will automatically create PR's on its own for us to review, and very easy to selectively merge parts or not and tell it to delay until later. We do this on OpenRefine project. Want me to add that in...oh wait, I can't I think because it needs owner approval I think on token exchange. So you can do that.
I'd change this issue to a title of "Add Dependabot integration". Where we then just add Dependabot into our GitHub workflow. It will automatically create PR's on its own for us to review, and very easy to selectively merge parts or not and tell it to delay until later. We do this on OpenRefine project. Want me to add that in...oh wait, I can't I think because it needs owner approval I think on token exchange. So you can do that.
https://docs.github.com/en/code-security/dependabot/working-with-dependabot but start here: https://docs.github.com/en/code-security/dependabot/dependabot-alerts/configuring-dependabot-alerts