[jokoon]

What happens when a vulnerability is discovered? What happens when the library's dependencies gets deprecated?

I mostly agree with you, but 5 years is not very long time either.

[dncornholio]

> What happens when a vulnerability is discovered? What happens when the library's dependencies gets deprecated?

The same as what happens with non-shitty code, you fix it.