First thing I do on seeing a new go lib is check the go.mod for dependencies. ~25 direct dependencies is too many Firstly it's a security problem: not only h

First thing I do on seeing a new go lib is check the go.mod for dependencies. ~25 direct dependencies is too many Firstly it's a security problem: not only have to vet this code, but also all the dependencies, and all their dependencies. It's going to be be quicker to just write the bits of this lib that I need (especially if I can copy/paste the tricky bits from here). Secondly, it shows that the maintainer wasn't being careful about their deps. That when they see a problem, they hunt for a solution that looks like it fits rather than really trying to dig in to the problem and grok it and work out the best solution. I'm all for not re-inventing the wheel, but you have to understand your load, your road surface, your motive force and your steering mechanism before deciding on a wheel design. Adding a cartwheel to a Formula 1 race car is not going to bring the happy faces. Too many dependencies is a sign of lazy thinking