Dependabot
GitHub's automated dependency updater — opens PRs when your packages have new versions or security holes.
Acquired by GitHub in 2019, free for all repos. Configured via .github/dependabot.yml. Three alert types: security (CVE in a transitive dependency), version (just a newer version), group (combine multiple bumps in one PR). Supports npm, pip, Maven, Cargo, Go modules, Docker base images, Actions and more.
Competitor: Renovate (more configurable but steeper learning curve). Most orgs use Dependabot for security alerts + Renovate or in-house automation for version bumps.