Slower than a server fix. After you update the SDK, the build goes through store review and then reaches users in stages. Apple's phased release takes seven days to reach everyone with automatic updates, and Google Play staged rollouts only grow when you raise the percentage. Plan for days, not hours.
What the stores document
Apple. Phased release spreads an update over seven days: 1 percent on day one, then 2, 5, 10, 20, 50 and 100 percent. Selected users are a random sample with automatic updates on, and anyone can download the update manually at any time. You can pause for a total of 30 days. You can also choose Release to All Users once the version is ready, which ends the phase.
Google Play. A staged rollout sends an update to a chosen share of users, picked at random. Per Google, the percentage does not increase automatically. You raise it yourself. Halting stops more users receiving the version, and those who have it keep it. Google's page describes no rollback. If a bundle is faulty, you halt and release a new one.
What this means for a vulnerable SDK
Users who have not updated stay vulnerable until they do. Store phasing is about managing risk of the new build. For a serious vulnerability you may decide to release to everyone sooner. That is a judgment call about the flaw against the risk of a bad update.
A response timeline
| Stage | Question |
|---|---|
| Hour 0 | Is the vulnerable library in our build, and is the code reachable? |
| Hours 1 to 24 | Is a fixed version available, and does it work with our target platform? |
| Day 1 to 2 | Build, test, submit for review |
| Rollout | Stage it, watch crash reports, widen when stable |
| After | Consider a minimum supported version, see below |
The first row decides everything. If you cannot answer it quickly, because nobody knows what is in the build, you lose the first day. Keep a current inventory per release.
Reduce the exposure window
- Keep an inventory for every released version, so you know which versions are affected.
- Use reachability analysis to separate flaws your code can trigger from the rest.
- Mitigate on the server where you can, for example by blocking a malicious request pattern.
- For critical flaws, plan to retire old versions. See forced updates and minimum OS version.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how the demo identifies a fixed version. That is the step that starts your clock.
Quick check
Can I roll back a Google Play release?
Google's staged rollout page describes halting, not rollback. The remedy it offers is a new release with a fix.
Does phased release slow down manual downloads?
No. Apple says anyone can manually download the update from the App Store at any time.
Safeguard's reachability analysis helps you decide whether a vulnerable library is actually exercised, and autonomous remediation can open fix PRs, off by default with every category on Manual. See the free scan.
Sources
Last reviewed: 19 October 2026.
