Not only that, extremely risky. It's an "all or nothing" approach versus starting at low risk and moving up. I think this is really important to remember with

Not only that, extremely risky. It's an "all or nothing" approach versus starting at low risk and moving up. I think this is really important to remember with log4j and other vulnerabilities cropping up. It really sucks updating a single dependency version and having your dependency tree explode in conflict. It sucks even more when that prevents you from updating all your apps since they're all part of the same monolithic codebase