Security is more of my concern: these things change constantly and versions can even be completely replaced, so even if you convinced someone to do a full security audit (and they checked all the dependencies of the dependency, etc. etc.) I still don't think I'd feel entirely secure.