Package dependencies policy

[jpinelo]

Should we have a policy for integrating package dependencies?
My view on this is that we should include these carefully and only as absolutely necessary.
For example, we could agree to the following:

• Only consider dependencies which are stable, supported and frequently updated.
• Always justify the addition of a dependency based on user requirements.
• Always discuss the potential introduction of a dependency before merging with the main branch. Ideally, bring it up for discussion even before testing.
• Use environment stack. Should keep development packages (e.g. profiler) separate from deployment ones.

What do you think?