Hi there!

I'd like to propose incorporating a dependency update tool to maintain up-to-date CI dependencies. Keeping dependencies up-to-date is a recommended security practice that minimizes exposure to known vulnerabilities and bugs while also mitigating the risk of being immediately affected by potentially malicious or vulnerable releases. Dependabot, for instance, can provide a delay and notify you about new security or release patches.

I'll submit a PR with a configuration for Dependabot, but please let me know if you prefer Renovatebot or another tool. Your thoughts on this would be greatly appreciated.

Furthermore, I strongly recommend enabling the Dependabot security updates option in Code security and analysis to receive unscheduled upgrades whenever a new security patch is released, reducing the potential exposure time.

Thanks!

Context

I'm Joyce, and I collaborate with Diogo (#216 and #224 ) on Google's Open Source Security Team (GOSST), working closely with the Open Source Security Foundation (OpenSSF).

Our primary mission is to identify and implement security enhancements for widely used open-source projects. By doing so, we aim to bolster the overall security landscape and ensure a safer digital environment for everyone.