Debian has vcswatch to keep track of updates. I think it only works if the upstream repository keeps the Debian control files updated, but keeping track of commits that update a generic CHANGELOG file should be simple.
That said, I don't think the vendor can be avoided unless you want to live on the edge. If you're on a released version of a distro (otherwise, you wouldn't have to cherry-pick from Sid), chances are you're not on the latest version of the software, and the patch has to be backported by the distro maintainer to version you are actually on.
That said, I don't think the vendor can be avoided unless you want to live on the edge. If you're on a released version of a distro (otherwise, you wouldn't have to cherry-pick from Sid), chances are you're not on the latest version of the software, and the patch has to be backported by the distro maintainer to version you are actually on.