You're right, by trusting any outside source for a dependency, you're still dependent. But as you noted, there's the option of adopting the software yourself an

You're right, by trusting any outside source for a dependency, you're still dependent. But as you noted, there's the option of adopting the software yourself and injecting it as vendored or something similar. Proprietary doesn't even have that. Depending on the project, it may move slow enough for the dependency to be slow to update and it be fine. Depends on what you're doing. At least in the case you mentioned, I can revert to an older version and freeze it there until my business can sort out the way forward. Ideally, one chooses dependencies that are easy to replace and reasonable to maintain for a bit, if needed. Or if you're lucky, no dependencies at all!