I'd prefer that we change the dependabot config to turn it off for many webservices components.

Typically we don't merge these in isolation, or if we do there has been some side validation that went on first. The effect is these dependabot PRs end up taking a lot of my time for not much benefit, and they clutter up the PR queue.

These dependabot PRs end up basically being a notification that an upgrade is available. The component upgrade report send to the wildfly-dev list each week is a better way to keep on top of what's available.

I'm only talking about components that are only used in the webservices modules here. The usage of a component can be easily checked by

git grep <artifactId> | grep module.xml