You seem to consider convenient dependency management a security hazard, which I have always found to be a pretty weird take. It logically follows that the seve

You seem to consider convenient dependency management a security hazard, which I have always found to be a pretty weird take. It logically follows that the severe difficulty of managing dependencies in C and C++ projects is actually a security feature, or how else are we supposed to understand this opinion? Let's not pretend that anything is better on the traditional C/C++ side, where the approach is usually one or more of: 1. Vendoring dependencies in-tree. This can result in security problems from missing out on bugfixes upstream. 2. Reinventing functionality that would otherwise be served by a dependency. This can result in security problems from much less battle-tested, buggy in-house implementation. In closed-source code, this is effectively security by obscurity. I've seen both of these cause issues in large C++ projects. For reference, the Rust/Cargo ecosystem contains a lot of tools and infrastructure to address supply-chain security, but it will always be a difficult problem to solve.