Software maintenance
After launch, the steady work that keeps a live product safe and running: dependency upgrades, security fixes, OS and store changes, and repairs when outside services change.
Updated October 2026 · with examples from our own builds
What does software maintenance mean in practice?
Software doesn't stay finished. Libraries publish security fixes, frameworks drop old versions, phone operating systems and store policies change, and third-party services alter their behaviour. Maintenance is the steady work of keeping up so that none of these becomes an emergency.
Budget for it as a running cost; needing it isn't a sign the build was poor. Some products carry more of it by nature, such as anything that depends on another company's pages or APIs.
Regular maintenance is the cheap kind. A dependency audit every few months is a short job; one after years of neglect means major version jumps that force code changes.
Software maintenance at a glance
- Includes
- Dependency and security updates, OS and policy changes
- Heavier for
- Products that depend on other companies' pages or APIs
- Cheapest when
- Done regularly rather than after years
Where has software maintenance come up in our builds?
On 16 June 2026 npm audit reported 38 vulnerabilities on the backend, from 1 critical to 4 low. Each was closed by a real upgrade, a maintained replacement or removing an unused package, with nothing suppressed; moving mongoose from 5 to 8 closed the critical one, and the audit then read 0 on both the backend and the client.
The risk register names maintenance as a fixed cost, because LinkedIn's page changes regularly break the selectors automation relies on, and the proposal specifies signed, self-updating desktop releases so fixes reach users quickly. Discovery only.
Common questions about software maintenance
How do I know if my app's dependencies are out of date?
Ask your team to run the package manager's audit and outdated reports and share the results. Anything marked critical or high deserves a fix plan with dates.
Can we just suppress dependency warnings?
You can, but it hides real risk. Close each finding with an upgrade, a maintained replacement or removal, and document the rare case where no fixed version exists, as Flying Pup did when it pinned an unaffected release of its rich-text editor.
Related terms
Sources
Planning a product and not sure where software maintenance fits? Ask us, or browse all 116 terms in the glossary.