The default way would be to install the package unattendedupgrade which will install security updates on your system every day.

Depending on how pihole is installed, this may not upgrade it. I personally have it installed with docker and uses watchtower for updates, but the risk with this mechanism is that it can break things.