It looks like Apache Infra has flipped on dependabot for all projects. It's not configured right for our purposes. I assume that our local configuration will sorta override their global one, so I sense that since we've flipped it on ourselves for everything we probably should switch it on for Go/Java at this point as they are the only components left not having a run. Unless there is some concern, I'll go ahead and make a note to do that after release as part of reopening the release branches.
