https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically Having knowledge about vulnerabilities of the dependencies helps the project owners decide on their dependencies security posture to make decisions. If the project decides to get updates only on security updates and not on any version updates then setting these options would not open any PR 's open-pull-requests-limit: 0 |
||
|---|---|---|
| .. | ||
| ISSUE_TEMPLATE | ||
| workflows | ||
| CODE-OF-CONDUCT.md | ||
| CONTRIBUTING.md | ||
| dependabot.yml | ||
| PULL_REQUEST_TEMPLATE.md | ||
| SECURITY.md | ||