Review and pin your direct dependencies. With transitive dependencies it doesn't differ from trusting large dependencies in general. The alternative to micropa

Review and pin your direct dependencies. With transitive dependencies it doesn't differ from trusting large dependencies in general. The alternative to micropackages has significant downsides. Pulling in extra surface and rolling your own buggy implementations while waiting for some commitee to bikeshed years on the implementation. Making the right thing easy rather than the wrong thing hard is a lot better approach.