Similarly, if you use Composer, it can cache things for up to 10-15 minutes. Also, Drupal.org’s subtree split process takes 5-10 minutes to push out a new core

Similarly, if you use Composer, it can cache things for up to 10-15 minutes. Also, Drupal.org’s subtree split process takes 5-10 minutes to push out a new core update to Packagist, so if you wait for the update using Composer it could be 20-30 minutes. The most reliable method is to use Git, Drush, or the patch plugin with Composer to apply the patch immediately, and push it out to your servers. Then update to the latest core version and push that out to your servers once it’s ready. The security team usually links to the raw patch file for each new version in the CVE.