Also, vetting a dependency != auditing and testing every line of code to find all possible bugs. If this bug was an open issue in the project's repo, that migh

Also, vetting a dependency != auditing and testing every line of code to find all possible bugs. If this bug was an open issue in the project's repo, that might be concerning and indicate that proper vetting wasn't done. Ditto if the project is old and unmaintained, doesn't have tests, etc. But if they were the first to trigger the bug and it only occurs under heavy load in production conditions, well, running into some of those occasionally is inevitable. The alternative is not using any dependencies, in which case you'd just be introducing these bugs yourself instead. Even with very thorough testing and QA, you're never going to perfectly mimic high load production conditions.