> You can't be a productive web developer, according to modern standards, and review every single transitive dependency that gets pulled into your application.

> You can't be a productive web developer, according to modern standards, and review every single transitive dependency that gets pulled into your application. Applications I encounter use a ridiculous amount of outside tooling to do relatively simple work, and that's where I see dependencies explode most often. When I work on package managed, env managed projects, every other day is a new environment issue, configuration issue or version mismatch. It's all a colossal waste of time. Had the project just chosen a handful of comprehensive tools and committed them to the repo, there would be no dark rituals of configuration and package management to perform. The code is in the repo, the code works with itself, life is good.