If you lose track of your dependencies you are just asking for supply chain attacks. And since xz we know resourceful and patient attackers are reality and not

If you lose track of your dependencies you are just asking for supply chain attacks. And since xz we know resourceful and patient attackers are reality and not just "it might happen". Sorry but sprawling transitive micro-dependencies are not sustainable. It's convenient and many modern projects right now utilize it but they require a high-trust environment and we don't have that anymore, unfortunately.