Dependency bloat is a problem in all popular programming language ecosystems, but has proven to be statistically a bigger deal in the JS ecosystem than in other

Dependency bloat is a problem in all popular programming language ecosystems, but has proven to be statistically a bigger deal in the JS ecosystem than in others. Real problems this causes: 1. security surface area. Running npm audit in many large projects is going to give you scary results. And that's just the known advisories. 2. 3rd-party support. How many of the 1000+ packages you've ended up pulling into your node_modules will continue to be actively maintained throughout the life of your project, what stability pains will dead subdependencies cause, and what will the long-term maintenance cost of rooting them out (and finding equivalent replacements) be? Will it cause forced deprecation of features in your app? So with all the above, low-dependency/no-dependency projects are attractive. Many go to extreme and repeat the old mistakes of NiH. Rome seems to me to be this extreme kneejerk (and liable to some serious lock-in). The sensible thing here is moderation: just choose dependencies carefully.