You added the dependency to server/lib. You standardized on versions, and applied only security fixes, testing them in a separate environment first. You only upgraded versions of libs if you had a critical feature you couldn't live without, of if your existing libs were about to be deprecated and out-of-support.

I'm not saying it wasn't a dark time, but it had its merits and drawbacks just like everything else.