I'd be interested to see the project author's reaction to this. Will he downgrade to an older version of the library out of principle?
This whole thing is a matter of choice, and we shouldn't necessarily conflate the role we take when we consume/use a dependency/tool with the role of crafting own things. I, for one, can apply agency solely on things that offer me means to change them.
> Turns out to not audit dependencies