> The problem is bloat in the dependency tree. Nobody wants to individually vet a thousand plus library authors and enterprise/government or just anyone who car

> The problem is bloat in the dependency tree. Nobody wants to individually vet a thousand plus library authors and enterprise/government or just anyone who cares a lot about supply chain security is not likely to consider "number of downloads" on crates.io a reliable proxy of trustworthiness. That problem does not magically go away with a bloated stdlib. Take Java, for example, with it's colossal list of standard modules, with which Rust cannot possibly match or even rival. Yet, any reasonably sized Java project still ends up dragging in dozens of third-party modules to the point that not using a dependency management system is unheard of.