Log4j: The pain just keeps going
If you automatically update your dependencies all the time, you will constantly get new bugs, issues and sometimes even malware.<p>If you don&#x27;t update your dependencies all the time, you will be vulnerable to old bugs and issues.<p>The current software engineering paradigm <i>has no meaningful answer to this</i>, no matter what &quot;security experts&quot; tell you. In a sane industry this realization would lead to a change of the paradigm, but people in our industry seem to be only doubling down.<p>&quot;Use a build tool to do dependency checks!&quot;<p>And then what?<p>&quot;Only update libraries if they have vulnerabilities.&quot;<p>So, should this be a manual process where I have to dig through obscure warnings every time I build something?<p>&quot;No, you can automate it!&quot;<p>Congrats, you&#x27;ve just outsourced the decision making process about which versions of libraries to use to some 3d party. You&#x27;ve also made your build process reliant on yet another online service.<p>&quot;But it&#x27;s not a hard dependency, you can still build if the 3d party service is off.&quot;<p>So the exact software you compile will depend on whether or not you can connect to a 3d party service? Do you understand the actual implications of this?<p>Etc. People with clever advice don&#x27;t seem to think it through. We&#x27;re fighting fragile complexity of too many tools ducktaped together by ducktaping more tools to the whole setup. Again and again and again.