Adding a dependency is a serious commitment requiring an audit and continued re-auditing, and the usual practice of not doing so is reckless.

Adding a dependency is a serious decision which requires consensus within the team, an audit of the new dependency, an understanding of its health and long-term prospects, and an ongoing commitment to re-audit them and be prepared to change course as necessary.