This issue of dependencies is exacerbated when a popular library has old and unmaintained dependencies 2-3 levels down that have security holes, and taking them

This issue of dependencies is exacerbated when a popular library has old and unmaintained dependencies 2-3 levels down that have security holes, and taking them out is a huge refactor. I hope the JS community is moving away from this model, and I think a good example of that is DayJS.