The beauty of the unbundled approach is, though, that you don't need to rebuild anything except the vulnerable thing. It scales. Having to rebuild the whole wor

The beauty of the unbundled approach is, though, that you don't need to rebuild anything except the vulnerable thing. It scales. Having to rebuild the whole world, not so much, even if you can do it. Maybe you have access to an infinite supply of zero-cost energy, but I don't, and neither does the world at large. When they find a critical bug in a Go module or a Rust crate, you usually end up with a litany of packages that had to be updated as well because everyone and their crab relies on that crate/module. Count in release managers (or whatever that's called at your shop) who pin all dependencies to the most exact minor version before shipping, because they have learned to do it like a mantra without actually understanding all the "whys" of it and just keep religiously applying that hammer everywhere. People keep complaining about how distributions work and how the traditional package management sucks all the time (of thousands complaining, I estimate that maybe 20 people actually know what they are talking about and thus are qualified to whine), but they somehow keep forgetting that those tools exist for a reason and that they are about to rediscover it the hard way. Chesterton's fence and all that.