I set this up a while back (and recently moved to Forgejo, see the update note at the beginning of the article):

nickcunningh.am/…/how-to-automate-version-updates…

Probably a tad overkill honestly but it works amazingly well, and turns every potential upgrade into an approval process so nothing will update when you don’t want it to.