Since when does Dependabot bump the lower version of a package?

[jenstroeger]

Hello, I’m somewhat puzzled that Dependabot has changed behavior and now bumps both lower and upper version range… unasked?

See for example an older PR jenstroeger/python-package-template#1185 and then the most recent PR jenstroeger/python-package-template#1222 for the same package which bumps both sides of the range? The latter is not a correct bump because it turns the valid package range into an exact pin which is not what I’m interested in.

First glance at the docs didn’t reveal an option to disable this behavior.

Thanks!