I've seen this happen in a few teams now, and it's a real security debt trap. Dependabot PRs pile up, get auto-merged by stale bots, or just linger until a vulnerability makes headlines. It's not just about the tool—it's about making security maintenance part of the workflow.
What's working for teams that handle this well? I'm looking for concrete strategies, not just "enforce policy." For example, one team I know schedules a short, weekly "dependency review" block. Another integrates the alerts into their sprint planning with a severity threshold. But I'm sure there are better patterns out there.
Have you successfully shifted this from being noise to being routine? I'm particularly interested in how you balance urgency, especially for non-critical updates, without burning out the team. What makes a developer actually want to click "merge" after checking?
--mod
Be excellent to each other