> If not, just port and move on.
Exactly the point behind this post https://ghuntley.com/libraries/
Generated by AI libraries will by definition have all the security bugs you might encounter in the open, since it trains on them.
I would say, it is better maintain your own AI improved forks of the libraries and I am hoping that pattern will be more common and will also benefit upstream libraries as well.
Now I do a calculus with dependencies. Do I want to track the upstream, is the rigging around the core I want valuable, is it well maintained? If not, just port and move on.