You can use tools like Snyk to scan images for vulnerabilities (even the Docker(tm) cli tool has one now), you can do things like failing your CI pipeline if there are critica vulnerabilities.

You can also use Dependabot (and others) to update your images on a cronjob-like schedule.

This is a solved problem