And, following semantic versioning, it's always a new feature, not even bugfixes.
But eslint is not the only one, and when Dependabot gives you a storm of Pull Requests, this is exhausting to manage.