I've written a script to automatically upgrade external tools similar to what dependabot does. We could enable it in ci weekly or smth https://github.com/pantsbuild/pants/pull/22064 Here is an example output https://github.com/pantsbuild/pants/pull/22065 (ready for merge)