Wheeler: Insecure open source software libraries?

It may be acceptable to bundle libraries if you are serious about keeping your bundle up to date, but if can't guarantee that then you should definitely not bundle any libraries with your releases. Chromium probably does an ok job there.

Bundling causes many problems though and should always be avoided. At a minimum it should be easy to replace the bundled libraries at compile time. (In the case of Chromium it is not.)