We'll have to agree to disagree if you see equivalence there. Even the smallest transitive dependency in our largest dependency graph in the Java ecosystem isn

We'll have to agree to disagree if you see equivalence there. Even the smallest transitive dependency in our largest dependency graph in the Java ecosystem isn't someone's 6-liner afternoon project. I think the ease of publishing + ecosystem of small modules is a good thing, it just has what we consider an ecosystem-level security trade-off that matters for some applications.