That's one reason I barely use any dependencies. I'm forced to use a couple, but I tend to "roll my own," quite a bit.

Well, I should qualify that. I do use quite a few dependencies, but they are ones that I wrote.

Requiring the use of lockfiles and strict adherence to checking updates, also helps. I tend to use dependencies for many things, but ones I've trusted over a long time, I know how they work, often chosen because of how they were implemented, so I can see the updates and review them myself. Scaling up to a team, you make that part of the process whenever you add a new dependencies, and someone's name always have to be "assigned" to a dependency, so people take ownership of the code that gets added. Often people figure out it's not worth it, and figure out a simpler way.