# A Single Discretionary Update Channel Is a Security Dependency ## Claim When security patching reaches users through one channel controlled at a single party's discretion, the governance of that channel is part of the security architecture, not separate from it. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds when no verifiable alternative distribution path exists and the channel operator has unilateral authority to withdraw access — the current state of the WordPress.org plugin and theme repositories. - Breaks when mirrors, signed independent repositories, or contractual continuity commitments give users a fallback that doesn't depend on the operator's goodwill. ## Evidence The court accepted, at the pleading stage, that WP Engine customers lost automatic updates, security patching, and plugin management when Automattic cut WP Engine's access to WordPress.org between September and December 2024 — forcing customers to perform those tasks manually without the benefit of the hosting plans they'd purchased. That's a concrete, litigated instance of a general fact: sites in the affected window ran without patches or with manually applied ones, a measurable increase in exposure that no amount of application-layer diligence could have prevented, because the dependency sits below the application layer. ## Links - [[Open Source Governance MOC]] — channel governance as a security property, not an administrative detail - [[3. Resources/Permanent Notes/Publishing a Competitive Artifact Publishes Evidence of Your Knowledge]] — because evidence-for; same court order, same underlying fact pattern about a single party controlling shared infrastructure. - [[3. Resources/Permanent Notes/Dependency Properties Become Product Properties Regardless of Application Effort]] — because extends; accessibility and security both propagate through a dependency graph and both must be verified where the dependency enters. - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — because applies-in; infrastructure-access continuity belongs in the same risk register as plugin and theme supply-chain review. ## Tests / falsifiers - If a documented, tested fallback path for loss of .org access exists in writing anywhere in the ecosystem, the "no alternative" scope condition weakens and the claim's urgency (though not its structure) is overstated. - If hosts routinely mirror the plugin/theme repositories already and simply haven't publicized it, the actual exposure window is shorter than the litigated facts suggest. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Readwise/Articles/Class Action Against Automattic to Proceed After Judge Finds Company Tracked WP Engine Customers]] — the court's acceptance of the disruption's concrete harm.