The way around this is to use dependencies sparingly and to just lock in a version. I can't say how many times in Java for instance I've pulled in a library use

The way around this is to use dependencies sparingly and to just lock in a version. I can't say how many times in Java for instance I've pulled in a library used one or two features then shipped. A few years later in support security will start auditing stuff and ask for updates and upgrades for patching. To which there's usually a conversation along the lines of, "I'm sorry, Richfaces doesn't exist anymore." There are ways around this, it's like managing every risk. I think the dependency anxiety comes from a mixture of knowing that solving the problem would be to use a language like Java or Go, for their rich frameworks and simplicity. What holds you back and creates the anxiety is the downside that the tech stack stops being sexy and interesting. On crypto libraries, you've got options here. you can not do crypto in your app and push that into infrastructure and use some other app as a proxy to handle that work. This gives you freedom from issues because you can manage that layer by swapping in and out different ssl proviers/clients.