Unexpected github notifications due to @mentions in release notes

[vbreuss]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

Nuget

Package manager version

No response

Language version

No response

Manifest location and content before the Dependabot update

No response

dependabot.yml content

No response

Updated dependency

No response

What you expected to see, versus what you actually saw

I currently receive lots of unwanted github notifications from @dependabot from completely unrelated repositories, because I contributed to open source repositories that are being updated and am mentioned in their changelog:

Examples:

• Bump FluentAssertions and 5 others VMelnalksnis/Testcontainers#123:
• Bump Ardalis.SmartEnum.EFCore and 43 others onebeyond/onebeyond-studio-obelisk#236
  
• Bump AwesomeAssertions and 32 others tbui17/test2#12
  

Expected behavior
I am not notified from dependabot in arbitrary repositories!

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

No response

Smallest manifest that reproduces the issue

No response

[martincostello]

Another example: SSWConsulting/SSW.VerticalSliceArchitecture#178

[ManickaP]

This is pinging and subscribing a lot of developers of .NET on quite a bit of random repositories, examples just from this morning:

• Bump the system group with 3 updates devlooped/Merq#252 (comment)
• Bump the extensions group with 4 updates devlooped/Merq#253 (comment)
• Bump Microsoft.Extensions.Logging.Console and Verify.NUnit WildGums/Orc.Monitoring#120 (comment)
• Bump the all group with 1 update tryAGI/Groq#50 (comment)

[martincostello]

Looks like this was caused by #12661.

[akoeplinger]

@brettfo @JamieMagee I see that there's an experiment flag, can you use that to turn off the new behavior until this is fixed?

[brettfo]

Apologies all for the spam mentions. I've just posted #12685 to insert a zero-width space which should break the mention.

[brettfo]

Fix has been deployed, I'm monitoring error telemetry for a few minutes before I merge and release the deploy lock, but the fix is live now.

As someone absolutely drowning in notification spam, again, my apologies. If any of you can corner me in person, I'll buy you a beer.

[dword-design]

This still seems to happen in michijs/htmltype#214. Any idea why?