  Dependency management bots automatically open pull requests to update
software dependencies on behalf of developers. Early research shows that
developers are suspicious of updates performed by dependency management bots
and feel tired of overwhelming notifications from these bots. Despite this,
dependency management bots are becoming increasingly popular. Such contrast
motivates us to investigate Dependabot, currently the most visible bot on
GitHub, to reveal the effectiveness and limitations of state-of-art dependency
management bots. We use exploratory data analysis and a developer survey to
evaluate the effectiveness of Dependabot in keeping dependencies up-to-date,
interacting with developers, reducing update suspicion, and reducing
notification fatigue. We obtain mixed findings. On the positive side, projects
do reduce technical lag after Dependabot adoption and developers are highly
receptive to its pull requests. On the negative side, its compatibility scores
are too scarce to be effective in reducing update suspicion; developers tend to
configure Dependabot toward reducing the number of notifications; and 11.3% of
projects have deprecated Dependabot in favor of other alternatives. The survey
confirms our findings and provides insights into the key missing features of
Dependabot. Based on our findings, we derive and summarize the key
characteristics of an ideal dependency management bot which can be grouped into
four dimensions: configurability, autonomy, transparency, and
self-adaptability.
