You can get patched open source from the upstream project, from your operating system vendor, or from a managed or curated provider. Upstream is fastest to new features, vendors give stability with backported fixes, and managed providers add curation and support. Pick per package by how critical it is and how fast it changes.
Option 1: Upstream
You take releases directly from the project's registry or repository.
- Good: newest fixes and features, no middle party.
- Costly: every upgrade is yours to test, and a fix may only land in a new major version.
- Best for: fast moving libraries you actively develop against.
Option 2: Your OS or platform vendor
The vendor packages the software and backports security fixes into the versions it supports. Red Hat describes this as taking a fix from a newer upstream release and applying it to an older version it still distributes, so customers avoid a risky migration.
- Good: stable behaviour, predictable support dates, advisories tied to CVE names.
- Costly: version numbers can mislead scanners, and you trail upstream features.
- Best for: system libraries and runtimes where stability is the priority.
Option 3: A managed or curated provider
A provider builds, patches and supports components, often across more ecosystems than a distribution covers.
- Good: one place to apply policy, support for versions upstream has dropped.
- Costly: you depend on the provider's coverage, response time and honesty. CISA's Secure by Design guidance says producers should take ownership of product security rather than push the burden to customers, which is the standard to hold a provider to.
- Best for: older estates with many dependencies and little patching capacity.
How to choose per package
Ask three questions.
- How critical is it? Internet facing or sensitive data paths justify the most care.
- How fast does it change? Fast moving packages favour upstream, with strong tests.
- Who can patch it if upstream stops? If the answer is nobody, favour a vendor or provider.
Mixing sources safely
Most real estates use all three. Keep a record of which source each component comes from, so that when an advisory lands you know which advisory feed and which fix path apply. Make sure your scanner understands vendor advisories to avoid false alarms on backported fixes.
What does not change
Whichever source you use, you still need to deploy the fix and check that it worked. A patched package sitting in a registry protects nothing until it is running.
Safeguard covers the inventory and prioritisation parts of this with SBOM and dependency scanning and reachability analysis, and you can try a free scan at gold.safeguard.sh/scan. Autonomous remediation with fix PRs is off by default, and every category starts on Manual, so a person approves changes.
Quick check
Is vendor patched software always safer than upstream?
Not always. It is often more stable and well supported, but fixes may arrive on the vendor's schedule rather than upstream's.
Can I mix all three sources?
Yes, and most teams do. Record the source per component so you know where to look for each fix.
Sources
Last reviewed: 19 October 2026.
