HOW DEPENDABOT ACTUALLY WORKS

Summary from the TLDR Dev newsletter

Dependabot-core is an open-source, stateless Ruby library responsible for the mechanics of tracking and updating dependencies across numerous package ecosystems. The full Dependabot service, including scheduling, state tracking, and pull request coordination, is managed by GitHub's proprietary infrastructure, making the service difficult to replicate independently. The library itself is a massive and complex codebase that often resorts to workarounds to handle ecosystem-specific nuances.