Pulling the list of security updates is trivial. And during development you'll know what you depend on. Comparing the two in a script is trivial. But regardles

Pulling the list of security updates is trivial. And during development you'll know what you depend on. Comparing the two in a script is trivial. But regardless, with containers, it should be a setup where you can rebuild your images daily with all the latest security fixes. Or whenever there is a fix you deem important.