[dhab]

How do you know there are less vulnerabilities in a smaller package than there are in a better adopted one(usu bigger)? And isn’t it more likely that big packages (they got big I feel due to expanding user-base requirements) get the patch sooner?

[mrkeen]

You can't have vulnerabilities in code which isn't there.

Compared to what I could be using, my ideal stack does not have: class loaders, virtual machines, dependency injection containers, web application servers, Log4J, etc.