govulncheck is the much better answer and we use it.

We also let renovate[bot] (similar to dependabot) merge non-major dep updates if tests pass. I hardly notice when deps have small updates.

https://github.com/search?q=org%3Amoov-io+is%3Apr+is%3Amerge...