In maplibre-gl I've added some flows to automatically merge PRs from dependabot if they pass CI.
It requires setting a branch protection and setting CI runs as required, but it removes a lot of the manual work around upgrading dependencies.

Yeah, we should implement that too. I think there is tons of work to get this repo into a better state, such as testing, linting, better CI, local testing, updates to dockers, rename primary branch, and zillions of other things ;)

Yup, the best way to solve this it to prioritize I believe.
For me the priorities are:

1. Create an official release including npm + docker (currently there is only a pre-release) - assuming this is semi-automatic, otherwise make is easier to create a new release.
2. Change default branch name to main
3. Automate dependecies upgrade
4. After most of the dependencies are up-to-date (hoping most of them don't have breaking changes) upgrade lint rules
5. Other stuff...

sounds good to me! Thanks for looking into this!!!