> include an upstream jar directly in the project, as opposed to the Linux distro model where you use your distributor packages so you have security and bug fix

> include an upstream jar directly in the project, as opposed to the Linux distro model where you use your distributor packages so you have security and bug fixes good luck getting all your versions to be compatible if you do that. Oh, now your java app can only run on Ubuntu 16.04? But our customers use CentOS 7? Guess they're out of luck. > EDIT: this may help answering the question "do I use log4j?", because transitive dependencies can be complicated! Just run `mvn dependency:tree` or the gradle equivalent.