[c0nfused]

I generally agree with the thesis here.

Adjacent points: I also think that selecting mature projects for your dependencies matters significantly. My old couchdb or early node work is generally defunct. On the other hand, I have some dotnet projects that are still functional with zero updates from a decade or more ago.

Additionally, it's reasonable to keep a copy of your dependencies somewhere in case the vendor dies, the licensing changes, or something else catastrophic happens. Even if you just image dev's machines when they offboard. There have been a few times this has prevented permanent project death or rewrite emergencies for me.