Dependabot is annoying if you use Nix since all of it's PRs are wrong.
FWIW, I don't think security updates are turned on by default anymore, so new repos won't have this problem.
That's the problem it tried to update dependencies without touching nix which would messed up the build. It assumed it knew how to update it, but did it wrong.