Since the Python Install Manager became available, some developers have started using it instead of Miniforge or other Python IDE-style managers. The problem is keeping the installed runtimes current: the manager does not appear to provide an update command, and it can install an older patch release such as Python 3.13.7 even though Python 3.13.15 is available. That leaves bundled OpenSSL libraries exposed to vulnerability reports. How are you managing Python runtime updates and ensuring that the installed libraries stay patched?
4 Answers
Another approach is to avoid language-specific installers where possible. Use distribution packages, internally built packages, or an approved internal repository, and scan the resulting images or hosts. For applications, explicitly vendor or bundle dependencies, or build them into an image when the application always runs in a container. Whichever method you choose, keep the dependency set small and generate an inventory so vulnerable transitive packages can be identified.
Tools such as uv can manage both project dependencies and the Python runtime, which is convenient when each project needs a reproducible interpreter version. It may not fit centrally managed workstations, but it is worth considering for development projects where repeatable environments and straightforward upgrades are the priority.
For development environments, a version manager such as mise can make this easier. Define the required Python version in a configuration file, pin it per project, and let the tool download the appropriate prebuilt runtime. It supports multiple operating systems, virtual environments, containers, and lockfiles, so updates can be tested and rolled out consistently rather than relying on whatever version a GUI manager happens to install.
First decide who owns the runtime inventory and patching process. Track the exact Python builds and libraries in use, flag outdated versions through the normal vulnerability-management process, and require the responsible team to update them within the organization’s remediation window. If the selected tool cannot install current patch releases reliably, changing tools may be the simplest solution.
That kind of declarative version pinning sounds useful. The important part for us would be making sure the pinned patch version is periodically reviewed instead of treating it as permanent.