Automation around picking up new `taffy` versions

Would Dependabot upgrades be sufficient here, plus asking an agent to fix/upgrade the implementation in the PR based on test failures and the release notes?