# StackRadar Blog

Arguments and field notes on keeping dependencies maintained.

- [The CRA puts a clock on the report. The fix runs on yours.](https://stackradar.com/blog/cyber-resilience-act-fix-time/) · August 14, 2026 · From September 2026 the CRA gives manufacturers 24 hours to report an exploited vulnerability. The fix depends on a number you set months earlier: upgrade distance.
- [Fresh, but not freshest](https://stackradar.com/blog/fresh-but-not-freshest/) · August 14, 2026 · Two ways a dependency hurts you: the version you never updated and the version you adopted the hour it shipped. The case for soak windows.

Markdown twins: append .md to any post URL path, or request the page with Accept: text/markdown.