It’s also how it’s hosted: running as an enterprise Java app means you’re getting a high/critical CVE every week for something you probably don’t even use but w

It’s also how it’s hosted: running as an enterprise Java app means you’re getting a high/critical CVE every week for something you probably don’t even use but which is bundled into something like Wildfly. Looking at it currently, I see SnakeYAML, the Apache SSHD, the H2 database, the Infinispan cache, etc. which are just generic Wildfly features and probably not even enabled, but you have to either be very confident about your ability to make that assertion or patching it frequently. This kind of service really needs to be lean and bundling only the dependencies it uses.