I'm a bit uneasy about GitHub's dependabot training me to merge pull requests claiming to bump up dependency version numbers without looking at the actual commit inside