Yes and I do that and Dependabot supports it but most people wouldn’t bother