There are 2 problems with dependabot, 1: it requires you to have a code on github orherwise you can't receive alerts 2: they send months old alerts, even if you go to check security advisory of github, you'll notice the date of those issues will be very old.