Currently we install pygments for SyntaxHighlight in the Shellbox container using a Debian package that I manually updated. Unfortunately this means that a root/SRE has to upload any new packaging to apt.wikimedia.org. People have gotten used to getting new pygments versions regularly, which is good though.
I think we're better off just installing it in a virtualenv with pip and adding it to the $PATH. That would allow any deployer to upgrade pygments.
From a security perspective, we should build it from the sdist (pinned to the hash) and not use upstream wheels. That also makes it easier to review the source to make sure it's not obviously malicious (but also, we're running this inside Shellbox).
Tagging ServiceOps new for a +1 on the idea, I can probably handle the implementation.