Stop thinking in npm versus pip versus composer.

Stop thinking in npm versus pip versus composer. The PHP RCE and the Brotli/CVE-2026-111497 fallout show the vulnerable unit is often a shared parser, compression library, or runtime component, not a package manager line. Your dependency plan should inventory components by lineage (libbrotli, the bundled Brotli in runtimes, PHP's request parser), gate upgrades by component ownership, and enforce decoding policies at the proxy or runtime boundary until those components are verified patched.