no. I think they mean how to navigate the non technical organizational challenge, not how to technically fix the thing

it’s a quite simple matter to fix a bug once it’s discovered, but how to deploy and where to deploy it when it affects a supply chain?

here’s an example: you can submit a vuln at a downstream dep and they can tell you it should be patched upstream. what should you do? open an issue upstream? maybe, probably not, probably the solution is to contact all downstream deps in order to get them to migrate dep or patch, because you just reported a vuln and they shrugged it off