Third-party dependency advisories drive time-bounded upgrade or exception records with owner approval, compensating controls, and CI enforcement so known-critical CVEs cannot ship silently while legitimate exceptions remain auditable and expiring.
This Block has no declared dependencies.