make their case as to why their PR should be merged.
* Developers submitting PRs after the code freeze and after the first release candidate must provide justification
for including it in the “.0” release. Otherwise, the PRs will not be merged until after the release.
* For large fixes (>100 LOC that’s not from generated files), SMEs from that area must also approve the PR.

version: 2
updates:
  # Go configuration for master branch
  - package-ecosystem: "gomod"
    directory: "/"
    schedule:
      interval: "daily"
    # Limit number of open PRs to 0 so that we only get security updates
    # See https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates