When running vulnerability scans, often a particular version of, say, Node.js is reported to be vulnerable along with a recommendation to update to a higher version. Then we also have insecure SSL/TLS protocols, like TLS 1.0 and SSL 3.0, and it’s recommended to disable them altogether. For me, any of the above recommendations is a change that needs to be applied to a given application, host, etc.
Now I’m wondering, how can one make sure that any of the changes does not lead to reduced or compromised security? How one can make sure that the new Node.js version is not introducing even more severe weaknesses / vulnerabilities? How does change management fit into this? In the end, updating the Node.js version or disabling unsecure TLS/SSL protocols is a change request, isn’t it?