[cpach]

IIRC there is some kind of SaaS solution for this but right now I can’t recall its name. Maybe someone else here knows?

Edited: I reached out to some security people and it seems like the following are popular tools for this use case: Snyk / Dependabot / Whitesource.

[gitgud]

Github have a security check that scans your repo's dependencies and warns you about vulnerabilities too