I figure if a dependency is good enough for a new project it's good enough for an existing one as well. Either way, it needs to be vetted.