Ask HN: How to be notified of vulnerabilities?

Do you have a service to recommend to be notified when vulnerabilities are discovered in software such as node packages, composer packages, linux distro versions, etc.? I try to not update things too much as it often breaks other things, but I’d like to be notified of important vulnerabilities and fixes.