Since the updateDependencies plugin has been removed, we do not have a way to make sure that com.nimbusds:nimbus-jose-jwt is aligned with the transitive version that is used by com.nimbusds:oauth2-oidc-sdk.
It seems that Dependabot does not support such an arrangement. One idea is to consider a custom Gradle task that makes that check for us and does not allow the build to pass if the versions do not match.