Hello! Just to be sure, PRs from dependabot can be accepted immediately? Do I need to review and and look for something in particular?

If it's something that runs in the CI like setup-python then yes. That particular one also updates the pypi-publish action, so in that case you should look at breaking changes, that one is just a patch version so it should be fine. In case you'd want to test it you can run the workflow that publishes to test pypi

Got it, thanks! And is that something I run locally, or it's a workflow I must run on GitHub?

You have to run it on github here

Ok, sounds good!