Dependency tracking was the primary issue because the company was in a regulated industry. Releasing patches for upstream existing open source was a secondary issue; GPL made this especially easy.