> 1. YOU are responsible for your dependencies. This is an understatement. I work in regulated environments where a software error has consequences. Dependenc

> 1. YOU are responsible for your dependencies. This is an understatement. I work in regulated environments where a software error has consequences. Dependencies must be vetted. If we end up relying on a dependency with known vulnerabilities the auditors are going to want to know what we did to mitigate the risk of this out-come. You need to have an answer for that question. I recommend packaging your upstream dependencies. That way you can patch vulnerabilities you find and ship those fixes today before those patches make it up stream. That's a risk mitigation strategy and often good enough to fend off auditors. Many (all?) open source licenses provide the software without any warranty or guarantee of merchantability or fitness for use. None. At all.