Comment by nineteen999
10 hours ago
> Install it once and never update it (and therefore hacked and malicious versions can never arrive in your dependency tree).
Huh? What if your once-off installation or vendoring IS a hacked an malicious version and you never realise and never update it. That's worse.
Hardly worth responding to, from other comments they're defending Java. They're not used to updates.