Sorry, I don't get it. I agree that there is a risk, but the risk is to need to do work at an unpleasant time you couldn't plan for as much as you wanted. "Risk

Sorry, I don't get it. I agree that there is a risk, but the risk is to need to do work at an unpleasant time you couldn't plan for as much as you wanted. "Risking your ass" risk is risk over which you could get fired. Let's use an example: years ago someone built something in Python 2.6 and added some library because it provided functionality you needed. Now you are in charge and need to upgrade to Python 3.7 because of $REASONS and the library isn't compatible nor maintained. How is this different from having written the library by yourself? You'll still need to do the transition. And yes, it probably would have been better if someone else did this for you or you knew before, but so is life. Years ago someone made a decision to postpone writing it from scratch and you inherited this somehow. There is a serious risk it will come like this, but this is not "you risk your ass" risk. No one will get fired over something like this. If someone is stupid enough to accept changes from upstream without reviews and an attacker added a backdoor to $AUTHENTICATION_LIB and you download version 0.9.1_hacked without checking if this is a legit update, that might be "risking your ass" risk. And someone might get fired for it. But probably is't.