I think the Log4j debacle makes it painfully clear that we simple can’t afford to trust application developers to keep bundled libraries up-to-date.

Good idea, doesn’t work.