I guess so. Dependency management isn't a solved problem. You can have all the CI in the world, green keeper, extensive package management toolchains and fancy

I guess so. Dependency management isn't a solved problem. You can have all the CI in the world, green keeper, extensive package management toolchains and fancy dedupe/version constraint solvers and still run into pretty catastrophic issues with usability and security. I don't think the log4j example is really relevant here. You can't compare all dependency-related issues to each other.