> but the lack of in-house java wizardry meant that we couldn't trust that small binary with regard to a spiraling vulnerability situation.

I've never experienced the problem of "nobody in my company knows Java well enough to trace the dependencies of a JAR". Do you all works in Rust and Javascript or something?