How should dependency vulnerability management be designed for production?

For production, maintain an inventory or SBOM where useful, scan continuously, prioritize exploitable findings, update promptly, remove unused packages, pin trustworthy sources, and verify that emergency upgrades do not introduce regressions. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.