To reiterate: "LGTM" is what happens right now with most out-of-tree dependencies listed in package.json and fetched JIT. To put it another way: keeping your d

To reiterate: "LGTM" is what happens right now with most out-of-tree dependencies listed in package.json and fetched JIT. To put it another way: keeping your dependencies in-tree or not doesn't directly impact code size. All the code is there in either case, whether you're checking it out as a consequence of cloning the repo or whether you're pulling it down via npm install. You're either already reviewing it, or you're not. On that specific factor you brought up (tendency to "LGTM"), there is no unique downside to storing the dependencies in-tree. It's illusory thinking to believe that there is.