Question about stagefright fix

I rooted my wife's note 4 back when she got it at launch with odin and cf auto root. I had no intention of updating her to lollipop as she hates change and wants her phone to remain the way it is when she got it. Typically this isn't an issue as most security related fixes have such a remote chance of affecting her or anyone that she is fine with the risk. However, this stagefright bug seems particularly bad and seems like it has a higher potential to cause trouble.

What is my best course of action to update her but retain root? She would murder me if her phone lost root (and lost the ability to block ads) I am comfortable using whatever method is best but since I've been here last a lot seems to have changed as far as root and which builds can be rooted and everything. I've looked for a sticky about updating or anything like that but there seems to be none. Is there a source I can use for information about updating?

Thanks.