Github has dependabot https://docs.github.com/en/code-security/dependabot/dependabot-alerts https://docs.github.com/en/code-security/dependabot/dependab... whic

Github has dependabot https://docs.github.com/en/code-security/dependabot/dependabot-alerts https://docs.github.com/en/code-security/dependabot/dependab... which can also raises PR's, though your mileage may greatly vary here depending on your language. You can also configure update of dependencies https://docs.github.com/en/code-security/dependabot/dependabot-version-updates https://docs.github.com/en/code-security/dependabot/dependab... These work with vendored dependencies too. (In our org, we have our own custom Go tool that handles more sophisticated cases like analyzing our divergent forks and upstream commits and raising PR's not just for dependencies, but for features. Only works when upstream refactoring is moderate though)