Merged dependabot PRs have embedded html in the commit message

[Torbjorn-Svensson]

This was raised in a call a few weeks/months back, but I raised this again in the meeting today.

An example of how the history in git looks like can be seen here: 5f55384

Commit messages like this makes it hard to read up on changes when just doing git log in the console.

[soumeh01]

This lengthy message includes HTML information on release notes and commits summaries, automatically generated by the dependabot GitHub action. Unfortunately, there is no configuration available to modify this. To maintain a clean and readable git log when merging these PRs, it's best to merge them without including this lengthy message. Interested parties can still find release notes and commit summaries in the PR history.

As I am managing the dependabot PRs, I will merge them without the lengthy message. The resulting commit message will be streamlined like 0a20108

Will this be helpful?

[Torbjorn-Svensson]

Yes, it would be better, but I don't understand why it's a problem for this repository.

As an example, dependabot is running for the npm/cli project and creates some PRs. One example PR is npm/cli#6916 with the corresponding commit npm/cli@5b21a3c. If you look at the commit, you see that there is no HTML in the commit message.
I have, so far, not come across any other repository where there are these ugly HTML commit messages from dependabot.

[soumeh01]

The presence of this HTML message in the repository stems from our utilization of the GitHub merge strategy for dependabot pull requests. Previously, I employed the GitHub squash and merge option, consolidating all commits from the feature branch into a single squashed commit, which inadvertently included the dependabot PR HTML comment as the commit message.

To address this issue, I propose adopting a new merge strategy: rebase and merge This approach preserves the individual commit messages, ensuring a linear history. Consequently, users will no longer encounter the HTML message; instead, they will see commit messages similar to those found here (As pointed in your example)