As a fellow commenter said, you would ideally use something like dependabot or greenkeeper/snyk.