Know what you build with
Choose fewer, better dependencies
Evaluate necessity, maintenance, ownership, update cost, alternatives, and removal before adding code to the trusted computing base.
8 minute lesson
A dependency can save months of work. It can also add a permanent update and incident obligation.
Prefer mature packages that solve substantial, difficult problems and have a credible maintenance path. Avoid duplicating platform features with abandoned wrappers. Record why a sensitive dependency was chosen and how it could be replaced.
A team considers adding a package to test whether a number is even. The package saves one line today, but it adds a maintainer account, registry release path, and update stream to the product.
Writing code locally is not automatically safer. A mature parser or cryptographic library is difficult to replace correctly. Compare implementation risk with continuing dependency risk instead of counting packages.
Write a one-page decision for one proposed dependency: add it, implement the feature locally, or defer it. Include the code size, maintenance activity, install behavior, replacement cost, and security impact. Test the decision against an edge case where the local implementation would be difficult to get right.
Lesson completed