Another option is reducing number of dependencies. Doesn't cure the problem but can cut the vulnerability surface by orders of magnitude. Transitive dependenci

Another option is reducing number of dependencies. Doesn't cure the problem but can cut the vulnerability surface by orders of magnitude. Transitive dependencies can, and frequently do result in The majority of the code in an application being unneeded. Using one function from a dependency can result in whole sets of libraries or even whole languages being included in the project.