Thats ok. The team can decide what process they do.

We do, update packages every 3 months. Criticals are reported by a pipeline and are fixed same week.