You can fork a package, but can you own it?

Mitchell Hashimoto's advice to fork dependencies and avoid unnecessary updates sparks a deeper reflection on what it truly means to own a dependency. The core argument is that most teams don't consciously decide to take on dependencies — they just install them — and that passive behavior is the root cause of supply chain attacks, license drama, and SBOM gaps. Forking works for small libraries but not for large ones like React. The real discipline is being deliberate: knowing your full dependency tree, assessing criticality and bus factor, and having a concrete plan if a maintainer disappears or goes commercial. LLMs don't change this calculus — they lower the cost of producing code, not owning it. A practical six-step framework is offered: inventory, criticality assessment, lifecycle strategy, bus factor analysis, mitigation planning, and response time estimation.