One of the problems as that the fixed version of log for j was on a newer version, like java eight. So if you were running java seven, you had to both, not just upgrade your library, but then upgrade your whole run time - which might be problematic. Of the good rules to go by is don't let your frameworks get too far out of date. Don't stay on jango one when jango four is about to be released. Or don't stay on python three six when you could be on nerana or something like that.