Is Dependabot able to scan Docker/OCI images?

[53845714nF]

Select Topic Area

Question

Body

I have just read GitHub Dependabot docs

If I understand correctly, Dependabot is able to scan my repo, including my Dockerfile.
It is also able to log in to my registry to make updates.

But does it also look directly into the images? It could be that my base image is compromised.