https://t0ul.com/tags/dependencies/Recent content in Dependencies on t0ulHugoen-usFri, 16 Oct 2026 00:00:00 +0000https://t0ul.com/blog/why-engineers-dont-patch/Fri, 16 Oct 2026 00:00:00 +0000https://t0ul.com/blog/why-engineers-dont-patch/<p><em>Part of a short series on the patch loop: who patches, who does not, and what it would take to close the gap. The research behind these posts is my own, and every number links to its source.</em></p> <h2 id="intro">Intro</h2> <p>I started from an uncharitable place. It seemed crazy to me that engineers will not do the one thing they are paid to do, which is write code and check that it works, because that is all patching is. You bump a version, you run the tests, you ship. So why does half the industry sit on vulnerable dependencies for a year?</p>