Ask HN: How do you evaluate external dependencies?

Whenever I need to pull in an external / third-party dependency I tend to evaluate following things, in order of priority:

1. License

2. How active is it (last commit, amount of em, etc.)

3. How many owners and contributors does it have

4. How deep is the dependency tree of the... dependency

5. Community support

It would be nice to know what other criteria there is used by others. How do you decide which dependency to pull in? How do you decide the threshold of when you should roll your own implementation vs pulling in an external dep?