https://nesbitt.io/2026/01/02/how-dependabot-actually-works.html