I don't actually want to allow dependabot. The reason is then Dependabot becomes a contributor, but it didn't sign the CLA. I think that's a problem. I don't want issues my code ownership or my company's!

I think I'm fine to include dependabot's contribs IF it will sign the CLA. So far it's refusing tho...hmmm, sus! haha :)