[MM3-users] How to keep virtualenv install secure?

Hi,

I am looking for some advice: If we use the virtualenv install method, how does one keep track of security updates for all the installed dependencies?

I can think of:

• Upgrade regularly all installed packages inside the virtualenv. This might break mailman3 if there are incompatible updates.
• Try to track all dependencies and check if there are security updates published. This might be impossible to achieve.
• Security updates are so rare, we do not need to bother. ;)

Thanks, Bernhard