otherwise unacceptable for use in the software system. Nor can the developer
predict whether a particular security patch may invalidate the security
assumptions that other components in the component-based system have
about the component to be patched.