Could it have been a Dependabot security update? These are different from normal Dependabot updates and do not require `.github/dependabot.yml`.