Relying on others' code.
WHAT THE RISKS ARE
Abandonment Breaking changes Security vulnerabilities Licence obligations Compromise of the package or its maintainer
WHAT TO ASSESS BEFORE ADOPTING
Maintenance activity How widely used it is How many dependencies it brings Its licence Whether you could replace it
WHAT TO PREFER
Widely used, actively maintained, and small.
WHAT TO PIN
Exact versions, in a lock file.
WHAT TO AUTOMATE
Vulnerability scanning on every build.
WHAT TO MONITOR
Advisories for what you depend on.
WHAT TO DO ROUTINELY
Apply updates in small regular steps.
WHY
Falling behind makes upgrading progressively harder.
WHAT TO DO ABOUT A CRITICAL ABANDONED DEPENDENCY
Replace it, fork it, or contribute to it.
WHAT TO CONSIDER CONTRIBUTING
Fixes you make locally, so you are not maintaining a private fork indefinitely.
WHAT TO RECORD
Every dependency, its licence, and why it is used.
