> my day job, wherein we run scores of Spring Boot apps written in Java 8 that have pages of vulnerabilities from tens of dozens of dependencies, which are not

> my day job, wherein we run scores of Spring Boot apps written in Java 8 that have pages of vulnerabilities from tens of dozens of dependencies, which are not easy to update because updating one library necessitates updating many other libraries, and oh my goodness, the transitive dependencies. At my job we have a fairly strict static analysis policy and starting in April it is going to get even more strict. Have you looked at https://docs.openrewrite.org/ https://docs.openrewrite.org/ to automatically upgrade your dependencies? I just migrated from Java 8, Spring Boot2 and Swagger to Java 17, Spring Boot 3.3 and OpenApi 3. It was pretty painless. Now, I still have update some dependencies and transient dependencies but the biggest hurdles were taken care of by the migrations.