Yeah, good point on the non-code-dependencies. While most of them I use have some big corporate backing, there's lots of small invisible things running everything getting little attention (like the old openssh story)