Techniques are disclosed for patching applications having software components with vulnerabilities. Upon receipt of a notification that a version of a software component has a vulnerability, a database of metadata is accessed to identify software applications which include the version of the software component. The identified software applications are cloned, and the version of the software component is replaced with a newer version which is free from the vulnerability to patch the application. The patched software application is then tested on a cloud computing test environment, and upon a successful test, deployed to a cloud computing production environment.