Use Dependabot for dependency updates?

I feel we just have to hold off here till “fork and PR” is a thing, any luck talking to GitHub?