Consider a maintenance strategy for the Dependabot PR backlog

There are currently several open Dependabot pull requests that have accumulated without being merged or otherwise resolved.

Some of them are routine dependency updates, but others can also affect security findings in the current dependency graph. For example, #1081 updates Testcontainers to 4.14.0, which includes the SSH.NET dependency update addressing the vulnerability that is currently also visible in downstream builds.

Would it make sense to define a more explicit maintenance strategy for Dependabot PRs?

Possible approaches could include:

• periodically reviewing and merging passing Dependabot PRs;
• automatically merging passing patch/minor dependency updates where appropriate;
• keeping major updates subject to manual review;
• prioritizing dependency updates that resolve known security advisories;
• grouping related dependency updates to reduce the number of individual PRs.

The goal would not be to automatically accept every dependency update, but to prevent dependency PRs from accumulating indefinitely and to make security-related updates easier to get into main.

Would such a maintenance policy be useful for this repository?