No. A release freeze stops your changes, not the outside world. New advisories keep arriving against code you already shipped. Keep scans running, keep triaging, and agree an emergency lane so a confirmed exploited vulnerability can ship during the freeze with proper approval.
What a freeze does and does not change
A freeze limits what goes into production. It does not limit what attackers learn about the dependencies already there. NVD reports submissions rose 263 percent from 2020 to 2025, so the stream of new records is large and does not pause for holidays or peak sales periods.
Some of the highest stakes freezes, such as end of year retail or quarter close, are also times when an incident costs the most.
Split scanning from shipping
| Activity | During a freeze |
|---|---|
| Scheduled scans and alerts | Continue as normal |
| Triage and ticket creation | Continue |
| Low and medium fixes | Queue for after the freeze |
| Exploited and reachable fixes | Emergency lane |
| Dependency update bots | Pause merging, keep opening, or batch |
The key is that triage continues. A backlog built during a freeze is still a backlog on the first day after, and decisions made in a hurry are worse.
Design the emergency lane
Write the rules before you need them.
- Eligibility: confirmed exploitation, such as a KEV entry, in a deployed and reachable component.
- Approval: one named engineering approver and one security approver, with phone numbers.
- Scope: smallest possible change, ideally a version bump or a configuration change.
- Testing: the standard fast test suite, no skipped checks.
- Rollback: a tested plan with a decision time limit.
- Record: a ticket linking the advisory, the approvals and the result.
Prepare before the freeze starts
Clear what you can in the weeks before. Rescan everything that will be live, patch what is reasonable to patch, and document accepted risks with review dates. Entering a freeze with a known critical backlog is a choice you should make deliberately.
Communicate
Tell the business what will still happen during the freeze. A single message that says scanning continues and an emergency lane exists prevents panic and prevents people from believing the system is unmonitored.
For related thinking on checks that run before changes land, see evaluating pull request gates: block, warn or observe.
Where Safeguard fits
Safeguard's gates and policies can be set to warn rather than block during a freeze, and reachability analysis helps decide what belongs in the emergency lane. Try a free scan.
Quick check
Can dependency bots keep running during a freeze?
They can open pull requests. Hold merging except through the emergency lane.
What qualifies for the emergency lane?
Confirmed exploitation in a deployed, reachable component, with no existing mitigation. Keep the bar high.
Sources
Last reviewed: 19 October 2026.
