A system library is usually easier to keep patched, because the distribution's security team backports fixes and you receive them through normal updates. A bundled copy gives you control over the exact version but makes you the maintainer. Choose by how fast you can rebuild and how much version control you need.
How distributions handle fixes
Debian's security FAQ explains the approach. Moving to a new upstream version is generally not considered a good solution for security fixes. Instead, the relevant changes are backported, so the release keeps the behaviour it had. The FAQ also says backporting is not always possible, and in those cases a new upstream version may be needed after coordination with the security team.
One consequence is that a higher or lower version number does not tell you whether a fix is present. A stable package can keep its original upstream version and still contain the patch. The FAQ suggests checking the package changelog or comparing your exact version with the one named in the advisory.
What you get with each choice
| Factor | System library | Bundled copy |
|---|---|---|
| Who writes the fix | Distribution security team, often as a backport | You, or upstream, through a version bump |
| How it reaches you | Package update on each target | Your own rebuild and release |
| Version consistency across targets | Varies by distribution and release | Identical everywhere |
| Visibility in an inventory | Package list on the host or image | Only if you record it |
| Time to fix after an advisory | Depends on the distribution | Depends on your pipeline |
When each choice fits
Prefer the system library when:
- You target distributions with active security support.
- Your product runs in an environment you rebuild or update regularly.
- You do not depend on a recent feature or a specific behaviour.
Prefer a bundled copy when:
- You target platforms with no reliable package source, or you ship to customers who control the host.
- You need the same version everywhere for testing or compliance.
- You have a build pipeline that can rebuild and release quickly.
If you bundle
You take on the work distributions do for you:
- Subscribe to the library's advisories and watch for fixes.
- Pin the version and record it, with its origin, in your SBOM.
- Keep a fast path from advisory to release, with tests.
- Track patches you apply, so an upgrade does not drop them.
- Set a review date, since pinned code ages quietly.
If you use the system library
- Declare the minimum version you require, and say which distributions you support.
- Build container images on a schedule so updates land.
- Read the distribution's own record of the issue rather than relying only on the upstream version number.
- Restart services after updates, since running processes keep old code.
Quick check
Is a lower version number a sign of an unpatched library?
Not necessarily. Distributions backport fixes, so check the package changelog or the distribution's advisory.
Can I mix both?
Yes, for example a bundled copy of one library and system copies of others. Record which is which.
Safeguard's SBOM and dependency scanning can build an inventory of the components in a repository, and the free scan at gold.safeguard.sh/scan is a quick way to see what turns up.
Sources
Last reviewed: 19 October 2026.
