Not sure if this is already mentioned already, but the auto-merge condition does not disallow you to have:
[compat]
UpstreamPackage = "0"
(But I’m not sure if this is an overlook of the auto-merge condition or my misinterpretation.)
It still introduces the upper bound. But, if the upstream declares that their API is stable (in a “real sense”), you should be fine with bounding the major version.
IIUC, this “solution” works now, without any additional tools.
A downside is that lower bounding this way is impossible (at least until the version range is implemented). However, given that Pkg.update and Pkg.add is rather aggressive ATM, that’s probably not the problem. Also, since package authors effectively declaring that they don’t care about compatibility by using = "0", it’s probably OK for them to not encoding any kind of compatibility information. (If they care UX a bit more, it’s not hard to emit warning via __init__. It’s probably easy to create SoftCompat.jl to warp it in an easier interface.)
Having said that, I’m not sure if = "0" is the right direction. CompatHelper.jl seems to be a much better solution once it is stabilized and more things are automated.