I think Maven's approach is functionally lock-files with worse ergonomics. You can only use the dependency from the libraries you use, but you're waiting for those libraries to update.

As an escape hatch, you end up doing a lot of exclusions and overrides, basically creating a lockfile smeared over your pom.

P.S. Sadly, I think enough people have left Twitter that it's never going to be what it was again.

> P.S. Sadly, I think enough people have left Twitter that it's never going to be what it was again.

Majority of those people came back after a while. The alternatives get near-zero engagement, so it's just shouting into the wind. For the ones that left over political reasons, receiving near-zero engagement takes all the fun out of posting... so they're back.

Of course it's functionally lock files. They do the same thing!

There's a very strong argument that manually managing deps > auto updating, regardless of the ergonomics.

P.S. You're, right, but also it's where the greatest remnant remains. :(