we have a public gradle plugin, which we release new versions, eg:
https://github.com/europace/docker-publish-gradle-plugin/releases/tag/v2.0.4
https://plugins.gradle.org/plugin/de.europace.docker-publish
After the release dependabot creates pull requests in several of our services as expected. But even though there are release notes the desciption of the pull requests is always empty. I would have at least expected some commit messages there.
Any idea why dependabot does not find those release notes?
The answer is that the main pom dependabot is checking is a pom generated by gradle publish plugin and they do not include the metadata.
In my case the example is here
Once gradle enables the metadata there or you publish to a different portal it will work