If it diverged far then we cannot do anything against it. and need to use the bundled one.

Static linking is bad in that way, that if a  security  problem arises from the static linked code, you always need to recompile the application and not only the lib.