There's obviously a tradeoff there. At some level of complexity it probably makes sense to import (and pin to a specific version by hash) a dependency, but at

There's obviously a tradeoff there. At some level of complexity it probably makes sense to import (and pin to a specific version by hash) a dependency, but at least in the JavaScript ecosystem, that level seems to be "one expression of three tokens" (https://www.npmjs.com/package/is-even https://www.npmjs.com/package/is-even).