The CRA puts a clock on the report. The fix runs on yours.
From September 2026 the CRA gives manufacturers 24 hours to report an exploited vulnerability. The fix depends on a number you set months earlier: upgrade distance.
Blog
Arguments and field notes on keeping dependencies maintained.
Fresh, but not freshest
Two ways a dependency hurts you: the version you never updated and the version you adopted the hour it shipped. The case for soak windows.