Given five COTS components, all on differentrelease schedules, all with
vulnerabilities reported and patches released at different times, the ability to
“freeze” the component-based software system at an acceptable baseline may
confound even the most flexible development team. Developers may have to