In the context of LOG4J2-3628 (replacing `maven-changes-plugin`), I am overhauling the `log4j-tools` project. I have done something, if I may say, A-W-E-S-O-M-E, which I would like to repeat for Log4j too at some point: https://github.com/apache/logging-log4j-tools/pull/5
What is exactly happening in this PR? dependabot creates a PR for a dependency update, CI executes the tests, tests succeed, CI merges the PR, and publishes the built SNAPSHOT artifact. No more manual dependency updates!