How do you keep Python runtimes and bundled OpenSSL libraries up to date?
Asked by
MellowCedar42
Since the Python Install Manager became available, some developers have started using it instead of Miniforge or IDE-specific Python managers. The problem is that the manager does not appear to provide an update command. For example, it may install Python 3.13.7 even though 3.13.15 is the current release in that series, leaving the bundled OpenSSL libraries outdated and triggering vulnerability reports. How are you keeping these Python runtimes and their dependencies patched and compliant?
Answers
Treat the Python runtime like any other software asset: inventory the exact versions in use, scan them, and assign ownership for patching. If a developer-managed installation violates your security policy, document it and require the responsible team to replace or update it within the required remediation period. Escalate overdue findings rather than assuming the installation manager will keep everything current.
Reply to this answer
For development environments, tools such as uv or mise can manage both Python versions and project dependencies. They can install a specifically pinned runtime, update it when a newer patch release is available, and keep the configuration in project files or lockfiles. That is generally more predictable than relying on whatever version an installer happens to offer.
Reply to this answer
Installing a newer Python package such as PyOpenSSL into an existing runtime may address a particular package issue, but it does not reliably replace the OpenSSL libraries linked into the Python interpreter itself. The safer fix is to install a newer Python runtime build or rebuild and distribute the runtime through a controlled package or repository.
Reply to this answer
A more controlled approach is to use operating-system packages where possible, then provide internally built packages or approved repositories for anything else. You can also vendor or explicitly bundle dependencies, or distribute applications in containers when they always run inside one. This makes patching and vulnerability tracking much easier than allowing every workstation to pull arbitrary language packages.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions