It doesn't happen automatically if you don't want it to (and it didn't happen automatically in this case). The value here is that it notifies you if an update

It doesn't happen automatically if you don't want it to (and it didn't happen automatically in this case). The value here is that it notifies you if an update is available (by opening a pull request), automatically tests the new dependency (when CI runs on your pull request), and makes it easy for you to apply the update if you want (by merging the pull request).