[chaxor]

Security risks, faster deprecation, and less flexibility.

If another dependency changes it's api, you immediately have a problem. Your answer may be to fix the version to a static value abd forget about it - but if a security vulnerability is found in that dependency afterward, what do you do? You probably won't even catch it.

[varajelle]

The alternative is to write the feature yourself. Probably not better from a security point of view. And you have to maintain it yourself.