developers and the configuration manager.
In the case of security patches, developers can never be sure when or even
if the supplier of a particular software component will release a needed security
patch for a reported vulnerability that might render a selected component