> Renovate Bot didn't do anything special.

Maybe it /should/ do something special though. Maybe it should stop using npm.

If it says "I updated package X" and it really updated X /and/ Y, then it didn't do what it promised. Maybe it should say "I updated package X and maybe also others I don't know…" that would be more accurate to how it currently works.