rely on package developers following semver Well, that seems naive. Almost 1/4th of Maven Central libraries broke binary compatibility in patch updates: https

rely on package developers following semver Well, that seems naive. Almost 1/4th of Maven Central libraries broke binary compatibility in patch updates: https://avandeursen.com/2014/10/09/semantic-versioning-in-maven-central-breaking-changes/ https://avandeursen.com/2014/10/09/semantic-versioning-in-ma... Netflix, at least, doesn't agree that Java doesn't need lockfiles: https://github.com/nebula-plugins/gradle-dependency-lock-plugin https://github.com/nebula-plugins/gradle-dependency-lock-plu...