Dependabot is being used to update our (most dev) dependencies. And we're using the simplest configuration (because simple is good).
But the intention for the dep-bot PRs for rubocop is that they be used only for review (providing a quick way to view updates to rubocop and to review new/updated cops).
It's probably worth tweaking the depbot configuration, to make it clear that rubocop PRs are not meant to be merged. (This should have the side effect of not changing our version spec style in gemspec. To preserve tidywaka instead of depbot's suggested: >=/<)