The dependabot bump to v3.0.0 updated the pinned commit hash but left the trailing version comment as v2.5.0.