Both are just such a horrible DX/hacky solutions that you have to go out of your way to implement/do... dependabot is filled with stuff like this, of stuff that should be simple but simply isn't (or isn't implemented at all, so you need to hack it to do so). Both are simply non-solutions when you can simply just drop in a renovatebot, have a config telling it exactly what to do, and it "just works".