Use a combination of registration, periodic checking, and dependency scanning tools.
Most importantly: agree on who will review notifications and who will decide on updates or replacements.
How do you keep track of licenses and vulnerabilities?
Open source explained in plain language.