Does `npm audit` add any value when using `dependabot`
Dependabot and npm audit both poll the Node Security Working Group database for Node-based projects. However, Dependabot has the added ability to check dependencies in numerous other types of projects as well.
Also, each report Dependabot generates includes useful info and links directly to a GitHub Advisory Database listing (e.g., CVE-2017-16021) that itself has multiple links to other listings such as NIST. On the other hand, npm audit's reporting is limited to a single link to an npm advisory listing with far less info (e.g., #100).
Overall, Dependabot covers all the bases — and more — that npm audit does. No need to use both unless you need a customized audit flow in your package scripts.