Urgent Fixes Delivery

Currently , in case of a critical security vulnerability and when we request a fix from IBM, we're given a list of files to replace in the product.

This breaks almost every pillar of SDLC discipline. Traceability gaps, audit failures , operational risk and long term technical debt.

Impacts:

1. No clear version number or build identifier so:

   1. Impossible to prove what code runs in production

   2. Hard to track which environments have the fix

   3. No artefact integrity (no checksum, no signature , no build pipeline)

   4. Supply-chain compromise

2. Auditors expect:

   1. versioned releases

   2. signed artifacts

   3. traceability from requirement > code > test > deployment

3. No guarantee that the way we apply will be the same that gets released in the next fixpack release due to the manual steps

4. Configuration Management Violation

5. Tickets raised to IBM may encounter issues as our business provides a version but actually what u deploy to your environment is different as we have a fix applied that doesn't impact the version

Our SDLC , compliance and change control processes requires a versioned , testable and traceable artifacts . Manual file replacement introduces audit gaps , security risks , and environment drift. We need properly packaged fix (patch installer , updated version or automated deployment artefact) that aligns with our governance requirements.