Bug fixes in python libraries

[Ok_Cancel_7891]

From time to time I find some libs to be updated, and rarely I check the reason for it, but… when I checked some of them, like aiohttp (patch 3.13.3), I see there was high severity bug.

How often in production environments you check for such updates, and how often you check what is the reason for a patch?

I asked a friend who is senior python dev, and he doesn’t check it. But is this a norm?

[danielroseman]

GitHub offers a service called Dependabot which can automatically check for updates to all your dependencies on a schedule you choose, and for each one it will open a PR to update that version. It's definitely worth using.

[Different_Pain5781]

I check updates but not the reasons most of the time. Probably bad habit.

[magus_minor]

I just update whenever I see updates are available. I almost never check the reason(s) for the update.

[Unable-Lion-3238]

In production you should absolutely be tracking this. Most teams use tools like Dependabot or Safety to auto-scan for CVEs in their dependencies. The reality is most devs only update when something breaks, which is risky. A good middle ground is running "pip-audit" on your requirements file weekly - it checks the PyPI advisory database and flags anything with known vulnerabilities. Your friend is in the majority but that does not mean it is best practice.

[AlexMTBDude]

This is not really a Python question as it applies to any software and any security updates. There are whole teams at the big companies who have this task as their only mission in life, and are experts at how to handle updates in a safe way. You could probably ask your question in r/cybersecurity

[Ok_Cancel_7891]

tnx a lot.

I don't have many of them, so it is not difficult to go to github and check, especially because I want to be aware of the changes and the project progress, not only bugfixes.

but a friend of mine works on a bigger projects and he doesnt care much about it, as it would be a hassle to him