I've recently received some pull requests from "dependabot" in a JavaScript library I am working on, like the one found here.
While I appreciate the effort to update dependencies to newer versions, it seems strange that each PR only updates the version in the yarn.lock file for libraries that are not direct dependencies of my project.
Should I consider accepting these changes? I had never really thought of managing the yarn.lock file as a separate task before.