You generally only want to put xpubs in software that either you wrote, or completely reviewed, including dependencies, and re-review with every release. This is because 1 derived privkey leak + xpub = full access.