Found this article today:

	https://research.swtch.com/deps

Pretty much encapsulates a lot of my reservations w.r.t. dependencies, especially the kind of rampant, convenient, online dependencies very popular these days.

My personal take is:

(1) Zero dependencies is the ideal situation.

(2) If copy-n-paste does the job, it's preferable over having a
dependency.

(3) Where unavoidable, the fewer dependencies the better.

(4) Offline dependencies should take priority over online dynamic
dependencies.

(5) Dependencies that themselves have no further dependencies are
preferable.

(6) Dependencies that have recursive dependencies should be avoided like the plague; if you absolutely can't avoid them, keep them at arms' length or at the distance of a 10-foot pole (isolate/sandbox them, interpose an abstracted API to make replacing them easier).


T

-- 
"You know, maybe we don't *need* enemies." "Yeah, dependencies are about all I can take." -- Calvin & Hobbes, deliberately misquoted. :-P

On Wednesday, 3 April 2024 at 20:20:01 UTC, H. S. Teoh wrote:
> Found this article today:
>
> 	https://research.swtch.com/deps
>
> [...]

Agreed -- generally if I must have a dependency, at the least I want the code and to be able to compile it myself.