Maybe if you're working for something that requires very high security but it's completely unrealistic that you can security audit all your dependencies. I'm pr

Maybe if you're working for something that requires very high security but it's completely unrealistic that you can security audit all your dependencies. I'm pretty confident Angular, React, Vue etc. don't have any glaringly obvious security problems that all the other contributors missed for example. Do you check the source code for Apache, MySQL, PHP etc.? If I'm picking a library for a component where its flaws would be high impact (e.g. security) and there isn't a strong community behind that library I'm going to be very cautious though.