>Creating a new project with one of the current popular frameowrks will bring in hundreds or thousands of dependencies. Who can possibly vet that? People who c

>Creating a new project with one of the current popular frameowrks will bring in hundreds or thousands of dependencies. Who can possibly vet that? People who care if their software works correctly. Everyone else relies only on herd immunity. If you have dependencies, you either belong to the first group or the second, and you make that choice. Neither choice is wrong, but it is still a choice you have to make and account for.