pull-type patch management