Skip to main content
    SolutionsUpgrades

    Upgrades that keep slipping. Every one of them is small.

    Framework, runtime and library moves, spread thinly across many repositories. Each individual change is well understood. The volume, the consistency and the review load are the problem — and work of this shape is deferrable in every planning round, which is exactly why it is still here.

    Reign Factory is in beta and being productized. It is not generally available; beta access is agreed with us and scoped in writing before anything runs.

    One move, many repositories one policy
    Decided once The move and the rules that make a repo eligible repository repository repository repository repository out of scope not attempted One policy five requests one review policy each one small The eligibility rules decide the scope. Nothing outside them is attempted.
    The version move is agreed once. The repetition is what the path is for, and the repository nobody agreed to touch is not touched.
    The cost

    Nothing here is hard. That is what makes it permanent.

    An upgrade backlog is not a knowledge problem and it is rarely a priority failure. It is a class of work that is individually small, collectively enormous, and always safe to move to the next quarter.

    01It loses every prioritisation round it enters
    A version move competes against work with a date on it, and loses, correctly, every time.

    There is no quarter in which upgrading a framework across forty repositories beats the commitment the business already announced. The decision is right each time it is taken and wrong in aggregate, which is the definition of a structural problem rather than a management one.

    AskWhen was the last time an upgrade won a planning round against a dated commitment?

    02The volume is the work, not the change
    One version bump is twenty minutes. The same bump across forty repositories, reviewed consistently, is a quarter.

    And it is a quarter of work that produces no new capability, which is why it is hard to staff and harder to defend. The unit that matters is not the change; it is the change multiplied by the estate, and then multiplied again by review.

    AskHow many repositories would a single framework move actually touch?

    03Deferring is often the rational call
    Three quarters of dependency-vulnerability patches break something.

    Teams that defer upgrades are not being lazy. They are pricing in a real and measured breakage risk against a benefit that is frequently theoretical — and most of the queue is not reachable in their code anyway. Any page that treats deferral as negligence is arguing with people who have been burned.

    AskWhat broke last time, and how long did it take to find?

    04The distance compounds while you wait
    The median dependency is now 278 days behind its latest major version, and that is 63 days worse than a year ago.

    The gap is not stable. Each deferral makes the next move larger, because a jump across two major versions is a different piece of work from a jump across one — and support windows close on their own schedule regardless.

    AskWhich of your services are already on a runtime nobody upstream is patching?

    Upgrading the tool is not this.

    If iTmethods operates your GitLab, Bitbucket, Jira or Camunda under Reign Ops, keeping that instance current is part of that service. It is scheduled through your change process, it is not a Factory engagement, and there is nothing extra to buy. Reign Ops even publishes upgrade currency — the share of operated instances held within a stated number of releases of current — as the measure it is willing to be held to.

    This page is the other one: the framework, runtime and library versions your own applications are pinned to, inside your own repositories. Reign Ops upgrades the instance. Reign Factory upgrades what runs on it.

    What is actually measured

    The drift is telemetry, not an opinion.

    These are the numbers that describe the shape of an upgrade backlog. Every one is somebody else’s, named with its date and its population. Two of them cut against us, and they are on the page for that reason.

    What is measuredWhose figure, and whenWhy it is on this page
    The median dependency is 278 days behind its latest major version — 63 days worse than the year before. Java: 492 days. Services deployed less than monthly are 70% more outdated than those deployed more often.Datadog, State of DevSecOps 2026, 26 February 2026. Thousands of applications across customer cloud environments.The last clause is the useful one. Drift tracks deployment cadence, not team diligence — which means it is a delivery-path problem and it responds to a delivery path.
    For 95% of downloads of a known-vulnerable component, a fixed version already existed. Four Java components alone accounted for 1.8 billion avoidable vulnerable downloads in 2025.Sonatype, State of the Software Supply Chain 2026, 28 January 2026. Registry telemetry across 9.8 trillion downloads; 1,718 open-source CVE records.“The answer is already known” is the premise of this whole page. This is the closest thing to a measurement of it.
    75% of dependency-vulnerability patches cause breakages. 24% require a major version upgrade. 90.5% of open-source vulnerabilities are not reachable at function level.Endor Labs, Dependency Management Report, 12 September 2024. Java, Python, Rust, Go, C#, .NET, Kotlin and Scala ecosystems.This is the row that argues against us. It says most of the queue is noise and most of the signal is expensive, and any honest version of this page has to carry it.
    Between 5% and 15% of components in enterprise dependency graphs are already end-of-life. 10% of services globally run an end-of-life language or runtime version.Sonatype, January 2026 (3,000+ enterprise SBOMs) and Datadog, February 2026.End-of-life is the part of the backlog with no upstream fix coming. It is the population where waiting stops being a trade-off and becomes a decision.

    The Endor Labs figures are from 2024 and we have not found a 2025 or 2026 restatement of them; their November 2025 edition covers different ground. Where a figure is older than the others on this page we say so rather than letting the newest date on the page cover all of it. None of these is an iTmethods measurement.

    How the work runs

    One move, agreed once, and then repeated.

    The same delivery path as remediation, pointed at a different population. What makes it suit upgrades is that the decision is taken once and the repetition is what is expensive — and the repetition is the part a path can absorb.

    01 Agree the move One named version move: this framework, this runtime, this library, from here to there. Not a program, one move. In writing
    02 Agree what is eligible Which repositories are in scope, which are excluded, and what makes a repository ineligible to be attempted at all. Yours to set
    03 A named engineer Embedded for the move, running it with your team and staying with it across the estate rather than handing it on. Not a queue
    04 One merge request per repository Sized for review, scoped to one repository, with the reason for the change stated on it. Consistency across the set is the point. Your repo
    05 Your tests are the test The checks that already run on that repository run on the change and report what they found. Nothing new gates the merge. No auto-merge
    06 What breaks is handed back A repository where the move needs a design decision comes back declined, with what was learned, rather than as a change nobody wants to unpick. Refusal recorded
    07 Your reviewer decides, every time Forty merge requests, forty decisions, all of them yours. Reign Factory does not merge and does not release. Named approver

    The only figures we publish about this way of working are our own. Across eight of our own repositories, 326 merge requests were merged. Median time from merge request open to merge was 19 hours. 326 of 326 merged with a recorded approval from a named iTmethods engineer. Measured on our own engineering, 11 July to 11 August 2026, GitLab, release commits excluded, internal environment only, two-person team. The method is written up in full at what we measured. It is not a customer result, and we do not present it as one.

    Where the record fits

    A version move is a governed change like every other change.

    Nothing about this population gets a separate route. The model calls made on the way to each merge request pass Reign Gateway and are recorded there; the merge request itself enters the pipeline every other commit enters. The reason to say so plainly is that a bulk change across forty repositories is exactly the shape of work an organization is tempted to fast-track.

    What the record carries
    For each call: the identity that made it, the policy that applied, the decision taken, the model that answered, and the time. Joined to the merge request it produced — so forty changes made the same way have forty records that say so, and a reviewer asked about the thirty-first does not have to reconstruct it.
    The part worth being precise about. This is a record of how a change was produced. It is not a judgment that the upgrade is safe, and it does not replace your tests or your review. iTmethods makes no compliance, certification or accreditation claim under any framework. How the boundary works → · Regulatory alignment →
    Shared responsibility

    Who holds what, across the whole set.

    Written down before the first repository is touched, because a move across an estate is the case where an unwritten boundary costs the most.

    WhoWhat they hold
    Reign Factory, automatedAttempt the move in each eligible repository. Open one merge request per repository, sized for review. Run the checks that repository already runs and report what they said. Carry the record of what was tried and under which policy.
    Customer authoredWhich move, and which repositories are in and out of scope. The eligibility rules. Your branch, review and release policy, unchanged. Every merge decision. Whether the set is attempted in one pass or in waves.
    Operating partner engagementThe named engineer embedded for the move. The repositories that came back declined, and why. The judgement about whether the remaining set is worth attempting at all.
    Before the scoping call

    The questions that arrive every time.

    We already pay you to run GitLab. Is upgrading not included?
    For the instance, yes, and there is nothing extra to buy. Keeping an operated platform current is part of Reign Ops, scheduled through your change process, and it is one of the few things this site publishes a measure for. This page is about a different population: the framework, runtime and library versions inside your own repositories, which nobody operates on your behalf because they are your applications. Reign Ops upgrades the instance; Reign Factory upgrades what runs on it. A customer can buy either without the other.
    Can we buy this today?
    Reign Factory is in beta and being productized. It is not generally available; beta access is agreed with us and scoped in writing before anything runs. For an upgrade population that means the move, the repository list and the eligibility rules are agreed before anything is attempted, and either side can stop.
    What if the upgrade breaks something?
    It will, in some repositories — the published figures on that are on this page and we are not going to argue with them. What the path is designed to do is make the breakage arrive as a merge request your tests failed, in front of your reviewer, rather than as a merged change in production. A repository where the move needs a design decision comes back declined rather than forced.
    Do you do end-of-life runtime moves as well as library bumps?
    The path does not distinguish between them; the scoping does. A library bump across forty repositories and a runtime move on four are different amounts of work per unit and different amounts of risk per unit, and we would want to scope them separately even if they are agreed in the same conversation.
    Will this reduce our vulnerability count?
    It might, and we will not put a number on it. Most open-source vulnerabilities are not reachable at function level, so a count that falls is not automatically a risk that falls — and we would rather say that than sell you a number that flatters both of us. What the path produces is proposed changes with their records attached; what they are worth is your measure.
    How do you keep forty merge requests consistent?
    One move, one set of rules, one named engineer across the whole set. That is the entire argument for doing it as one population rather than forty tickets. Where a repository needs to differ, the difference is visible on its merge request instead of being invisible in somebody’s branch.
    Which deployment shapes can we have?
    A single-tenant dedicated instance, in your own AWS or Azure account or in infrastructure iTmethods operates. Both are available today; Google Cloud is planned for 2027. Air-gapped and sovereign are in development. There is no multi-tenant or shared option at any tier. Deployment options states which is which without softening any of them.
    AWS Advanced Tier Services Partner SOC 2 Type II on Reign Ops
    AWS Advanced Tier Services Partner and Validated Managed Service Provider. Twenty-one years operating regulated engineering environments.
    Next step

    Bring us the move that keeps slipping.

    Name the version move and roughly how many repositories it touches. We will tell you which part of the set we think this path suits, which part we would leave alone, and why.