Review Dependabot config. Is it keeping up with everything possible?

[CritiqalPete]

What libs are covered and which are not that we need to track manually or some other way?
When should we prioritize these updates and what is a good sustainable pattern for a volunteer dev org to keep these going?