there are bots that can resolve this one angle of the problem. they have drawbacks that are great opportunities to improve upon - dependabot loves spamming projects with update notifications and doesn't understand what its actually doing - it is kind of a semi-smart regex parser. valuable but we can do better.