changes in upstream are to be expected and we want to be able to import them simply
Yeah, but should backporting/integrating/vetting all the upstream changes back into Geany be something a contributor working off our fork (necessarily, since they're hacking on Geany) should be responsible for? It would be different if we kept our fork up-to-date.