I'm interested in building a dependabot plugin that can read lockfiles and flag outdated deps [and optionally maybe think about bumping versions, though that's a bit trickier]. Before I embark on a Ruby adventure, has anyone got prior art?

There are a few prior threads of discussion crosslinked at: https://github.com/pantsbuild/pants/issues/14193