If you can't do the upgrade for another month or two, you should take your site offline. 1.3.8 has a number of well known serious vulnerabilities which could result in your customers having their credit cards stolen, passwords leaked, etc.