Dependencies are part of security
Applications depend on third-party packages that can receive bug fixes and security advisories. Keeping dependencies current reduces exposure to known vulnerabilities when compatible updates are available.
Automated update pull requests
GitHub Dependabot can create pull requests for dependency updates when configured for the repository's package ecosystems.
Review updates like code
Do not merge an update solely because it was automatically generated. Check release notes, compatibility, tests and any required migration steps.
ADVERTISEMENT