How do you keep Python runtimes and bundled OpenSSL libraries up to date?

A more controlled approach is to use operating-system packages where possible, then provide internally built packages or approved repositories for anything else. You can also vendor or explicitly bundle dependencies, or distribute applications in containers when they always run inside one. This makes patching and vulnerability tracking much easier than allowing every workstation to pull arbitrary language packages.

Installing a newer Python package such as PyOpenSSL into an existing runtime may address a particular package issue, but it does not reliably replace the OpenSSL libraries linked into the Python interpreter itself. The safer fix is to install a newer Python runtime build or rebuild and distribute the runtime through a controlled package or repository.

For development environments, tools such as uv or mise can manage both Python versions and project dependencies. They can install a specifically pinned runtime, update it when a newer patch release is available, and keep the configuration in project files or lockfiles. That is generally more predictable than relying on whatever version an installer happens to offer.

Treat the Python runtime like any other software asset: inventory the exact versions in use, scan them, and assign ownership for patching. If a developer-managed installation violates your security policy, document it and require the responsible team to replace or update it within the required remediation period. Escalate overdue findings rather than assuming the installation manager will keep everything current.