As with all end products where you need safety, all the dependencies (3rd party or not) you use should be treated as your own code. All the dependencies should be committed to SCM and reviewed before you deploy something into production, without any “automatic version bumping” magic that a package manager ala npm would otherwise do.