it’s tricky because browsers check certificates in 1 way, operating system tools check in another way, and programming languages often check in another way again… and if you run docker containers, they’ll need updates - not just your host OS

browsers should be fine automatically (they check for certificate revocation before even software updates), and system updates on linux at least should cover some things like node, but then you have eg python which ships CA bundles with libraries so will require package updates there or rust which (apparently) often compiles its trust store into its binaries so would require a recompile

this site will easily check browsers, and further down there are curl commands (curl will test your OS trust store), and you could load the same URL in various languages to test them, but again that’s a lot of work to go to when you also have to do that across all docker containers and virtual environments, etc and still tells you nothing about rust binaries

https://emudhra.we-have-a-problem.com/

same advice as ever: stay up to date, do the best that you can… upstream projects will get CVE reports for vulnerable libs, and it should be a very easy to backport a fix so security patches should be quick and easy, even on old versions of software

*edit: that site also lists minimum versions of a lot of things like OS packages, language packages, etc