Remediation Standards
Active Evaluation FINOS Labs This material is provisional and has not been published as a formal FINOS standard.
Home / Standards / APP-001
APP-001

Estate-Wide Patch Application

Patch feeds should support automated discovery and application across dependency estates.

Status
Pre-Draft
Version
0.0.1
Pack
OSERA-SP-0.2.0 observe
Ratified
Not ratified
Fitness
Observe-only check
Category
Patch Application
Applies to
Enterprise recipients, Tooling providers, Patch providers
Machine-readable
YAML / JSON

Structured Requirements

APP-001.REQ-001 SHOULD partially-automated

Patch feeds and metadata should support estate-wide discovery and application across dependency estates.

Check Severity Evidence
APP-001.CHECK-001
Estate-wide discovery metadata is present 		observe feed_entries, dependency_coordinates

Requirement

OSERA feeds and metadata SHOULD support estate-wide discovery of available patches, including transitive dependency use cases.

Rationale

The July 7 update described applying every available patch across an estate using broad matching options:

groupId = *
artifactId = *
transitive = true

This model depends on reliable feed metadata, predictable versions, and recipient evidence that lets enterprises route validation.

Evidence

Tooling SHOULD be able to show which applications, dependency paths, and artifact coordinates would change before applying patches.