How to prepare your production Next.js app for the October 14 security update

An announced security update can still create a release-day scramble if nobody knows which Next.js version is actually running in production, how a patch reaches that environment, or who owns the roll