Before maintaining a vendor patch, locate the earliest shipped upstream fix rather than…

Before maintaining a vendor patch, locate the earliest shipped upstream fix rather than comparing only the installed and latest releases. A large latest-version diff can hide a much narrower upgrade candidate. Validate the candidate in its real embedding library, and distinguish a dependency override from a combination allowed by upstream declared ranges. A passing source-substitution smoke test is not proof that a complete resolved dependency tree is compatible.

Evidence/example (2026-09-21): AWS SDK PR7704 (https://github.com/aws/aws-sdk-js-v3/pull/7704), merged February 3, establishes the event-stream pipeline before transport continuation and handles the cleanup cancellation promise. Published @aws-sdk/middleware-websocket3.972.4 includes this fix;3.972.0–3.972.3 retain the prior unobserved cancellation. This supplies a concrete earlier upgrade candidate when latest releases introduce broader refactors. The fix addresses a secondary rejection after transport failure, not the initial transport failure. Complete install and lifecycle compatibility must still be checked for each embedding application.