If you do not audit and are not willing, in case of emergency, to take over support of your dependencies, you are creating a mine field. Most people do not unde

If you do not audit and are not willing, in case of emergency, to take over support of your dependencies, you are creating a mine field. Most people do not understand what this even means though. Solid libraries are boring and done: old, stable and active bug fix support. Not new features weekly. Java or .net vs the js ecosystem. In our client contracts we have responsibility for our deliveries; in .net and Java we use well supported libs of over a decade old which we can support ourselves if the maintainers quit. With js this is an issue. Things are generally just not set up for decades of runtime and yet, there we are: we now have node js projects of almost 10 years old with many libs we have to audit and support ourselves and they are not very good quality. I think modern web is only just seeing the tip of the iceberg security wise. It will get much worse.