You can create a PR from the upstream to your repo, then accept that PR. (I know, that's not immediately intuitive, but at least you can do it without pulling a local copy.)
I know many don't like the 'dirty' history, but I like knowing exactly how the updates made it into my repo.