I am writing a paper on dependabot PRs and its interaction with developers. To this extent I have found some examples of dependabot PRs to analyse. The most information dependabot can provide you with is "Changelog", "Release notes" and "Commits" sections, plus the compatibility heuristic. But in some cases one or more of these are missing (e.g. this PR where none of it is presented). Why is it so? What defines which of these sections are present in the PR?
Also, in the example given above, why is the compatibility heuristic tagged as unknown even if the tests that were ran have clear results?
I'm the PM for Dependabot at GitHub. The answer to your question comes down to "our support for different ecosystems is different." Each ecosystem has a different way that they publish the changelog/commits information for each version bump, and some are more programmatic than others, which can make it easier or harder for us to pull the info needed to populate those fields.