Over time I have become skeptical of most dependencies. I wrote in Third-party Dependencies are Inherently Technical Debt:
[…] any third-party dependency is technical debt. Third-party? Here’s how I am defining it for the purposes of this article. You are the first party, the platform you are writing on (e.g. iOS, Android, React, NodeJS) is the second party. Everyone else is third party.
[Third-party dependencies are debt because] you need to constantly update them, […] they introduce breaking changes, […] they become unsupported, […] your platform adds their own incompatible implementation, [… and] they don’t update on the same schedule as the [platform].
To that end, I like policies that tend to reduce the number of dependencies you have. Here are a couple that I have seen work.
- Become a committer on any third-party dependency you take on. To be fair, you kind of owe that to the project.
- Donate to any third-party dependency you take on where you won’t become a committer.
- Fork the dependency and bring in updates carefully.
Seems like extra work, right? The extra work is why they work.