It's all very well complaining that "I only changed one line in a function that nobody uses so dependandabot shouldn't alert everyone", but - how is it to know that you only changed one line in a function that nobody uses without doing a thorough investigation of both the changes to the library, presumably building a complete call tree, and the (implicit or explicit) uses of the library in the client code as well.
If the complainant is that fussed, maybe he should produce a version of dependabot that does all that, and offer it as a replacement. I'm sure it'll run super fast.
I'm quite happy with "this thing you use has changed. rebuilding your thing is probably a good idea" alerts.
And in answer to one of the other "only update dependencies if your code has changed". Um. Why? What about when the library you're using has fixed a security issue in code that you use (possibly without realising, because frankly, most people have little idea of what goes on underneath the hood in libraries they use).
If you want to minimise your alerts from dependabot, you should not use external libraries. Obviously it's going to be a lot more work for you, but you can rest assured that the number of alerts you get will be much lower.