This is just an observation, that currently dependabot is tracking the main branch of our submodules and thus will produce PRs for all commits.
There is currently no way to get dependabot to only update submodules when a new version is tagged.
This is a long standing complaint:
dependabot/dependabot-core#1639
There is a PR to address this:
dependabot/dependabot-core#13052
But it is not yet merged.
Current strategy is to check manually if the update corresponds to a release, and to simply close PRs for main branch commits with no tags.
If this gets too annoying we can disable dependabot.
This is just an observation, that currently dependabot is tracking the main branch of our submodules and thus will produce PRs for all commits.
There is currently no way to get dependabot to only update submodules when a new version is tagged.
This is a long standing complaint:
dependabot/dependabot-core#1639
There is a PR to address this:
dependabot/dependabot-core#13052
But it is not yet merged.
Current strategy is to check manually if the update corresponds to a release, and to simply close PRs for main branch commits with no tags.
If this gets too annoying we can disable dependabot.