Looking after what you’ve already built

Friday mornings usually mean a bit of housekeeping for me. Coffee on the desk, editor open, and a run through the less exciting side of development.

I shared a thought about this on LinkedIn today. We spend a lot of time talking about what we’re building next, but looking after what we’ve already delivered deserves some attention too.

What my Friday maintenance looks like

The work varies, but my regular checks cover a few familiar areas:

• Checking dependencies and reviewing security advisories.
• Applying updates and checking that nothing breaks in the process.
• Reviewing logs, backups and application performance.
• Clearing out unused packages and unnecessary code.
• Checking that the websites and applications people rely on are running as they should.

An update deserves the same care as any other change. I want to know that the application still works after it, and that I’ve addressed the issue I set out to fix.

A clean dependency audit is useful, but there’s more to maintaining an application than its package list. The runtime, hosting environment and services around it need attention as well.

This week’s security reminders

On 21 October, the PHP project released fixes for CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities can allow unauthenticated remote code execution in affected installations. The PHP team urged users to update immediately.

The Node.js team also published a security advisory covering CVE-2026-111497, a high-severity flaw in its Brotli decoder that can permit remote code execution. The team released fixes for the 22.x, 24.x and 26.x release lines.

Reading those advisories means checking which versions and environments are affected, then following the maintainers’ guidance for the systems you run. A familiar framework or a recent application release doesn’t remove the need to check the software underneath it.

Critical vulnerabilities need attention as soon as they’re identified. I wouldn’t leave an urgent security update until Friday. Having a regular maintenance routine gives me time to keep track of the smaller changes and makes it easier to respond when something urgent comes up.

The responsibility continues after launch

When someone trusts you to build and maintain their website or application, they’re trusting you with part of their business. Their customers may rely on it. They may be putting their data through it.

That responsibility continues long after the first deployment. People still need to use the website, complete a form or get on with their work while we’re thinking about the next feature.

Maintenance rarely gives you much to show in a screenshot. A dependency update or a review of the logs might make a fairly dull project update, but I’m comfortable spending time on work that helps keep things secure and reliable.

Some Fridays are for building something new. This one is about looking after what’s already there, with a coffee beside me and a few fewer things left unchecked.