PHP published security releases for four supported versions last week. The instructions are short: upgrade.

Teams delay upgrades because they cannot predict what will break. That delay is part of their security posture, whether they describe it that way or not. A supported version and a dependency scanner look reassuring, but neither helps much when applying the fix is scary enough to postpone.

I want patch releases to be ordinary. Rebuild the container, run the test suite against the versions we claim to support, inspect the changelog, deploy. Without needing to reconstruct production first.

We spend a lot of time making feature delivery faster. Absorbing changes from outside the product deserves the same attention. If every small change asks the team to remember how the system really works, the system is already telling us what to fix.

A security release should test the software, not our memory.