Sick of "many dependencies" framing [LWN.net]

Sick of "many dependencies" framing

Posted Feb 11, 2026 15:31 UTC (Wed) by mb (subscriber, #50428)
In reply to: Sick of "many dependencies" framing by Karellen
Parent article: FOSS in times of war, scarcity, and AI

>If you have 100 dependencies of 5kLOC each, I don't see how you can answer those questions in any meaningful way.

https://crates.io/crates/cargo-vet

to post comments

Sick of "many dependencies" framing

Posted Feb 11, 2026 23:07 UTC (Wed) by Karellen (subscriber, #67644) [Link] (2 responses)

Wouldn't that work just as well for a few large dependencies if, for some reason, you didn't want to do the vetting yourself though?

I still don't see how many small dependencies is an improvement.

Sick of "many dependencies" framing

Posted Feb 12, 2026 2:44 UTC (Thu) by mathstuf (subscriber, #69389) [Link]

I think there's a higher chance that more people will review a small library than anyone will review "Qt" and give it a stamp of approval like this (beyond "it's got a lot of development behind it and Qt Company's track record is pretty good"). At which point, you're back to `cargo-vibes` instead.

Sick of "many dependencies" framing

Posted Feb 12, 2026 9:53 UTC (Thu) by farnz (subscriber, #17727) [Link]

You run into human nature again with the big dependency.

If you're using (say) Qt 7 for a Wayland application running on the Linux kernel, you don't benefit from Qt 7 having thousands of reviews scoped tightly to the Win32 code in Qt; you care about reviews of the Linux/Wayland code, not the Windows code. But the reviewers may well not bother to tell you that their review is scoped to the Win32 code - after all, they're reviewing Qt 7 as they use it, and they're assuming that you know that everyone uses Win32, because that's their life experience.

This puts you at high risk of the "thousands of irrelevant reviews" problem; you see lots of published reviews, and assume that the codebase is well-reviewed. But, in fact, those reviews cover the 80% of the codebase that everyone else uses, and not the 20% that's critical to your project.