- Dependabot only does security patches - One source of true for all versions like black and flake from the pipeline - Dependabot automatically merges updates as long as unit testing and release testing passes