Dependabot isn't very smart. Consider pmxbot/pmxbot#91, where dependabot unpins a dependency that's protected by a comment. If accepted, that pull request would leave a comment that's potentially no longer relevant to the version. If wonder if there's some syntax that could be used in the comment that would signal to dependabot why the dependency is pinned and what factors would need to change to revisit the pin (i.e. the referenced bug is fixed, a new release is made, and the minimum version now includes that new release).