Suggestions on evaluating dependencies. I would recommend using something like snyk.io’s advisor as well, which does a bunch of this as well as more (like some security checks).