You can still use dependabot to assist you with this. Let it only open PRs and it will show you the commits and changelog or at least a link to the source proje

You can still use dependabot to assist you with this. Let it only open PRs and it will show you the commits and changelog or at least a link to the source project in the PR description. Having a PR already open with a full test run done in CI saves a ton of time, at least in repos with a lot of dependencies.