Given recent events #log4j #log4jshell, here are some thoughts about dealing with dependencies and their versions in the Java-ecosystem when using #gradle. Some thoughts/explanations and an idea I had when thinking about the current state of things. Dependency management is hell. Always. If you rely on external open-source components, which again rely on other open-source components, you are already in trouble. Luckily, that's what everyone is doing. So we are all in trouble together.