Don’t deploy untested code to production. The fact that it’s a dependency doesn’t excuse a proper code review. It is ironic to me that software teams have code

Don’t deploy untested code to production. The fact that it’s a dependency doesn’t excuse a proper code review. It is ironic to me that software teams have code review processes and seem to trust each other less than random people they have never met on the internet. Every new dependency, you need to read the source. Read it completely. Every new change in every dependency needs to be reviewed as well. I’m a big fan of forking all dependencies and using only those forks in my code. Then, do upgrades via standard rebase or pull requests on that fork. If you have dependencies that are too large to do this with your time, you probably should avoid them in the first place.