Freeze routine updates during exams, enrollment, and grade deadlines, but keep a fast path for serious security fixes. A calendar freeze protects uptime when schools depend on you most. A freeze that blocks urgent patches trades one risk for another.
Why edtech has real peak periods
Student platforms have predictable stress points: first week of term, exam windows, report card release, and enrollment deadlines. An outage then affects thousands of families at once. Teams reasonably want fewer moving parts. That instinct is sound, as long as it has rules.
Two kinds of change
| Type | Example | During a freeze |
|---|---|---|
| Routine | Minor version bumps, refactors, new features | Wait |
| Urgent | Fix for a serious flaw in code your app actually runs | Allowed, with extra checks |
| Emergency | Active exploitation of something you use | Allowed immediately, with named approver |
Write the table into your release policy so nobody debates it at midnight.
Build a safe fast path
- Decide what qualifies. Use evidence, not fear: is the vulnerable code present in your build, is it reachable, is there a known exploit or an available fix?
- Keep staging close to production. If your test environment matches, a patch can go out in hours.
- Make updates small. One package at a time is easier to roll back than twenty.
- Have a rollback. Know how to return to the previous build, and test it before the freeze starts.
- Name an approver. One person with authority to say go, available during peak periods.
- Record it. A short note on what changed and why helps if a district asks.
Use the quiet weeks
The best way to make a freeze painless is to do the work before it. Run a dependency review two to four weeks before each peak period. Update what is overdue, retire what is unused, and fix what is serious. Entering a freeze with a clean list means fewer urgent exceptions during it.
Dependabot's own documentation shows one way to smooth this out. Version update pull requests wait three days after a release by default before opening, though that delay does not apply to security updates. You can customize cooldown periods in the configuration. A longer cooldown on routine updates plus an immediate path for security updates mirrors the policy above.
Tell your customers
Publish your freeze calendar to school administrators, including the fact that critical security fixes can still ship. Schools tend to prefer a predictable process to a surprise.
Try it yourself
Open the demo and look at how a fix that is available now is surfaced alongside the vulnerable component. That is the kind of signal that separates urgent from routine.
Click through it at your own pace, or open it full screen.
Safeguard's reachability analysis helps tell which findings sit in code your app runs, and its fix pull requests are off by default until you turn them on.
Quick check
Is a freeze a compliance requirement?
None of the sources we reviewed require one. It is an operational choice.
What if a patch is risky to apply during exams?
Compare the risk of the flaw with the risk of the change. If you cannot patch, consider a temporary mitigation such as disabling the affected feature, and record the decision.
Sources
Last reviewed: 19 October 2026.
