I used to work for the kind of companies that only use Struts+Spring+Hibernate, and it's simply appalling how many of their applications are running on year-old library versions with severe security flaws. One week is the median lead time for an emergency deployment.