For a “basic” check:
Latest systemcheck points out if the derivative repositories (Kicksecure and Whonix) are enabled or disabled. If the derivative repositories are disabled, a warning is shown by systemcheck. Furthermore, systemcheck also points out if the system is fully updated.
Note: Whonix is based on Kicksecure
For an “advanced”, manual check:
That is a bit difficult for now since we don’t have packages.debian.org APT package repository web interface for deb.whonix.org yet at time of writing.
First, I recommend updating according to documentation: Operating System Software and Updates
Because then you’ll see everything that is happening in detail such as the repositories where packages are fetched from as well as what packages are upgraded. When there is a Point Release you’ll notice a large number of packages being updated.
Does Package Version Check and Repository Version Check help?