Comment Re:Think in probabilities (Score 1) 47
It's really a question of what's the chance that any one package in the hundreds (thousands?) your solution is using directly or indirectly has
- A critical unfixed bug
- A dependency or code which will break on end of life of a language feature, library, system API call,
- The package will be taken over and malware injected into the code
- The package will become unmaintained or bump version number only zombie maintained
- The package license will be changed for commercialization or require server side runtime royalties
- A cloud vendor maintained package dies with end of life of one of the cloud services it uses
Deeper down in in the package dependency tree, the risk to the top level solution is higher since any one of those cases multiplies with the number of dependencies on that package.