Fix open source CVEs, without upgrades

Patch open source CVEs in the versions you already run (no upgrades)

Fix vulnerabilities in direct + transitive dependencies

Fixes before the CVE, and before a fixed version is released

Stay compliant without breaking changes or roadmap disruption