Recently found out about https://dependabot.com which creates PRs for you automatically which bump lockfile dependency versions when new versions come out - how would y’all feel about enabling it for the engine? It’s used by one of my random open source projects and generally looks pretty smooth