Dependencies are a loan against future maintenance.

You owe back what they owe upstream — every breaking change, every deprecation, every CVE. Read the lockfile like a contract. The interesting question isn't can I add this; it's am I willing to maintain this if the maintainer disappears tomorrow.