> You can't deploy a new library to close a library security hole, for programs that have statically linked it. Of course you can. You just recompile affected

> You can't deploy a new library to close a library security hole, for programs that have statically linked it. Of course you can. You just recompile affected programs. Just like you need to do in the case of header-only C/C++ libraries like much of widely-used Boost. And if the library is not strictly header-only, but still has significant code in headers, as is often the case in C++, if you only swap the dynamic library, the program is still broken, or much more likely: it becomes broken, even though it originally wasn’t.