A change window measured in months, not sprints
SCADA messaging infrastructure runs on change windows measured in months. A CVE fix has to be backported onto the exact version already qualified for the environment, not delivered as a version bump.
Challenge
SCADA and grid-control environments requalify every change against operational safety procedure before it ships -- a version upgrade is its own multi-month approval process, and a CVE doesn't wait for the next scheduled window.
Environment
RabbitMQ inside a SCADA or grid-operations messaging layer, on a broker version already formally qualified for that environment.
Approach
The fix is backported onto the qualified version rather than delivered as an upgrade, so it can move through the existing change-control process as a patch, not a requalification.
What this delivers
A CVE closed inside the operational change window that already governs the environment, on the broker version already approved to run there.