Outdated dependencies in GitHub

Enable Dependabot alerts and security updates if they are off. Add a dependabot.yml for version updates if you want weekly pull requests. Review the diff. A green check is not a review of a major bump.

For a public repository, GitHub also documents code scanning and dependency review as available by default. Private repositories need GitHub Code Security for those. Alerts themselves are in the "all plans" section of GitHub's security features page.