I’m sure writing their own ORM would have given them instantaneous insight into this issue and introduced no other challenges. Open source developers hate this one weird trick!
Especially for things used directly, you need to understand both, own and third party code, roughly to the same level. With own code, you only care for your own use case; with third-party — you have to kind of get everyone else's.
Depending on what you do and the dependency's scope, either way can make sense.
Depending on what you do and the dependency's scope, either way can make sense.