Copilot suggests a dependency that would simplify a feature. The team has not used the package before. What is the best next step?

1. Accept the dependency if the generated import statement passes linting.
2. Install the first similarly named package returned by the registry search.
3. Verify the package identity, maintenance, license, and security posture before deciding to add it.
4. Ask Copilot to pin any available version and skip the normal dependency review.