[bigDinosaur]

A compromise is to audit and then pin exact versions, or even copy and paste the code into your project. Yes, this is a clear tradeoff in that you'll lose access to newer updates, but it's certainly worth thinking about. I do it with relatively trivial libraries for things that I know the package has solved various edge cases, is small in scope, and probably won't be updated again, for example.

[shanebellone]

I agree with you, but I'd prefer to reinvent the wheel rather than audit an existing code base.