If you are on github/gitlab, renovate bot is a good option for automating dependency updates via PRs while still maintaining pinned versions in your source.

Chainguard, Docker Inc’s DHI etc. There’s a whole industry for this.