Easiest way to ship buggy applications
Do you remember the email you got to tell you that your jre had a vulnerability? No? What about the fact that Java 5 is in an end of life phase. Given the time it has taken for Java 7 to appear its has somewhat slowed the normal EOL pace of the Java platforms. You may not know that Java 1.4.2 for business will be supported commercially until April 2018, which is kind of mind-boggling. Thats like offering support for Windows 95 even now. At some point you should move and I would recommend most developers to be at least on Java 6 as its going to be around for a while.
Normally when your team releases your own applications as long as things are working the only reason to change exist underlying or dependent software is either to take advantage of new features or due to forced obsolesence by the provider of that software. Its difficult for an engineer or project lead to provide evidence as to why you need to update an application or what are the steps required to even upgrade if you wanted to. How quickly does your AMI , VMware or Azure image get out of date, who is even checking it?
If I look at the Java platform itself and really many of the main platforms, PHP, Ruby, .NET , perl, python etc, the pace of innovation has slowed. There obviously is still growth but its still chasing smaller footprints with apis in quick fixup mode after the first set of developers have released products.
My team has created a free service based on some technology we released over 5 years ago to check your Java platform and application and provide recommendations on what would need fixing and what you need to do next. It basically is a 5 minute scan and the reports are available to print out to show your boss. <ad mode on> if you are interested head on over to http://quality.spikesource.com <ad mode off>.