Done Criteria

A mechanism has been setup and documented for us to know if any of the repos that were copied into this Boxo have received "important improvements" in their original location.

Why Important

Some of the repos we copied as part of #202 (e.g., ipfs/go-car) have active maintainers (see #218 ). Fixes will likely get made there that we'll miss. Similarly, repos that are not maintained may get picked up by others and we'd like to know if improvements get made so we can evaluate whether to incorporate them.

User/Customer

Kubo maintainers to make sure they aren't missing out on other changes that should be pulled into Kubo.

Notes

1. Best intentions of checking on repos or having an individual subscribe to notifications on a repo doesn't count. It's not a mechanism.
2. I assume the best proxy for "important updates" is whether the maintainers of the original/source repo were willing to cut a release.
3. An idea that @BigLep believes he is capturing correctly from a verbal brainstorm with @guseggert : create a new module within Boxo or a separate repo where all the original repos are listed as dependencies. We can then let dependabot take care of notifying us with PRs that will show up in our triage when the original/source repos do a release. We will merge the PR to "update the dependency" once we evaluate what commits have changed and whether it makes sense to port any of them into Boxo.