dependabot `overrides` compatibility

[mfranzke]

dependabot most likely wouldn't update overrides entries, would it? So we would have some manual process afterwards. I would like to think about automatic solutions.