What's the benefit that we see here ?

@Jan0707

Dependabot can be configured to

• update composer.json as well
• automatically merge pull requests when the build passes

For reference, see https://dependabot.com/docs/config-file/.

I believe the most compelling argument is that pull requests can be automatically merged.

Apart from that, Dependabot has been acquired by GitHub and is the de-facto standard solution for updating dependencies for a wide range of package managers.

@Jan0707

Violinist currently updates composer.lock only, which is pretty much useless, as we run builds against lowest, locked, and highest versions.

I feel this would bind us even more to Github and its eco system. Is that a shared concern? If not then we could go ahead.

ping @localheinz
I assume you think this is a worthwhile trade-off ?

@Jan0707

With Dependabot moving natively into GitHub, I think that the switch makes a lot of sense.

In addition, the latest version of Dependabot allows updating GitHub Actions as well.