Find every copy of the library first, because C and C++ products often carry several: a package manager entry, a fetched source tree, a vendored folder, a static copy and a system library. Then update each by its own path, rebuild, verify the fixed version is in the shipped binary, and keep the evidence.
Step 1: Find every copy
Check these places, in this order:
- Package manager files, such as vcpkg.json and conan.lock.
- CMake declarations that fetch source (FetchContent and ExternalProject).
- Git submodules and folders named third_party, external or vendor.
- The base image or operating system packages your binary links at run time.
- Statically linked copies inside other libraries you depend on.
Our post on CMake FetchContent and scanners explains why steps 2 and 3 get missed.
Step 2: Pick the path for each copy
| Where the copy lives | How to update |
|---|---|
| vcpkg | Raise a version>= constraint or the baseline, rebuild |
| Conan | Raise the requirement, regenerate the lockfile |
| FetchContent | Change the pinned commit or URL and its hash together |
| Submodule | Move the pinned commit, then commit the new pointer |
| Vendored folder | Replace from upstream, re-apply your recorded patches |
| System library | Update the package, restart processes, rebuild containers |
Step 3: Check the fixed version, not a name
Read the advisory for the exact fixed release and any distribution specific note. If the library comes from a distribution, compare against that distribution's own fix record, since a fix may be backported under an older looking version.
Step 4: Rebuild and test
Do a clean build so no cached object or stale cache entry is reused. Run your tests, with extra attention on code that calls the affected function.
Step 5: Verify what shipped
- Compare the version in the new SBOM with the fixed release.
- For dynamic libraries, confirm the library file and the process restart.
- For static copies, confirm the new build identifier is the one deployed.
Step 6: Keep the evidence
Record the advisory, the affected versions, the fix commit, the build identifier and the date. Auditors and customers ask for exactly that sequence. See static or dynamic linking and who rebuilds for the link-type question.
Try it yourself
Open the demo to see how a fix that is available now is surfaced against a component. Follow the flow from finding to fix and note what you would still verify yourself.
Click through it at your own pace, or open it full screen.
Quick check
What is the most common miss?
A second copy of the library that no manifest lists, such as a vendored folder or a static copy in another library.
Do I rebuild if the advisory is for a shared library?
Update the library and restart. Rebuild anything that links it statically.
Safeguard's SBOM and dependency scanning can build an inventory of the components in a repository, and the free scan at gold.safeguard.sh/scan is a quick way to see what turns up.
Last reviewed: 19 October 2026.
