> Who’s going to carefully audit 10 deps when they’re transitive? I do. That is why I don't have many deps in general. Transitive or not. With only a handful o

> Who’s going to carefully audit 10 deps when they’re transitive? I do. That is why I don't have many deps in general. Transitive or not. With only a handful of dependencies that are from trusted sources and that are audited by me I can be sure that they are safe. With 1000+ dependencies that are from as many random sources you can not do the same. Having 10 dependencies is drastically different from a security aspect then 1000+.