While balancing that to performance requirements appropriate for the project. And picking dependencies that do the same while having a healthy community likely to keep going.

The same applies to picking vendors, asking questions like "will they extort me next contract renewal" and "what options do I have if they extort me".