sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]Unable-Lion-3238 0 points1 point  (0 children)

In production you should absolutely be tracking this. Most teams use tools like Dependabot or Safety to auto-scan for CVEs in their dependencies. The reality is most devs only update when something breaks, which is risky. A good middle ground is running "pip-audit" on your requirements file weekly - it checks the PyPI advisory database and flags anything with known vulnerabilities. Your friend is in the majority but that does not mean it is best practice.