Patching: the dirty secrets and how to fix them

This article provides practical guidance for managing third‑party dependencies and patch management across security, platform, and development teams, covering topics such as version pinning (minimum and maximum), automated dependency update PRs with CI gating, tracking end‑of‑support dates, and investigating whether vulnerable code paths are actually used; it uses the Log4j response as a case study to illustrate coordination challenges and recommended workflows to reduce friction during vulnerability response.