My big issue is that I wish Dependabot sometimes worked at a higher level. It makes all these pull requests at the CVE specific dependency level and that's rarely the level I care about. So many of those are dependencies of dependencies and just "lock-level" PRs. I understand that sometimes that's the approach least likely to break things, but it's also the approach that most doesn't reflect how I work: I don't know what that dependency of a dependency is, please send PRs that update higher level dependencies I care about.

> The other problem that I have is there is no easy way (probably for good reason due to potential abuse) to manually trigger Dependabot.

One of the announcements at BUILD this week was that Dependabot was getting added to a list of "Push protection" tools in GitHub Advanced Security so that it would run at least every push (and also optionally block pushes that don't address Dependabot concerns). Though it will be paywalled behind GitHub Advanced Security.