The Dependabot discussion should distinguish vulnerability alerts, security-update pull requests, and routine version updates. GitHub's configuration guide explains their different controls.
Follow one dependency through detection, a proposed change, tests, and the deployed version. Dismissing an alert records a decision; it does not patch the dependency. Likewise, an open update request has not changed the running application.
Akousa