The Anti-Dependency Manifesto

A package you did not pick

Install one package and many more may arrive with it. You chose a handful. The rest came through other packages, written by people whose code your team is unlikely to have read. It still runs in production with the privileges of code you wrote yourself.

Any one of those maintainers can affect your build. In the left-pad incident, the author removed a tiny JavaScript package after a naming dispute and broke builds across the industry within minutes. The XZ Utils backdoor took the slower route: earn trust in a foundational project, then use that position to place a backdoor in a release.

Teams accepted this because package managers saved a lot of time. For a long time that was a reasonable trade. The thesis is about why the trade moved. The risk of the graph did not.

What we do instead

We write the application libraries our products need. They start from specifications, get checked against established behavior, and are tested as product code. We use no third-party application packages.

The operating system, the hardware, the public network, and the development tools stay outside that claim. Those are real dependencies. The difference is there is no hidden package graph between our code and those boundaries.

A production app then has a short list: the application, the libraries we wrote, the operating system. There is nothing to resolve, nothing to lock, and no stranger's release notes in the path to a build.

That changes where the time goes. We do not spend it on version conflicts three levels down, or on advisories in packages we never call. We spend it on code we own.

When we would not

Writing more software does not mean writing it well. A mature open-source library can have more tests, more specialists, and more production history than a small team can match quickly. Replacing one without a test plan would be reckless.

We use public specifications, research, test corpora, and compatibility results. “Not Invented Here” is a fair charge when the motive is ego. Ours is ownership: change things on purpose, understand what we ship, and compare it against behavior the world already relies on.

This is a decision that should be made, not inherited from the package manager.

We built the library because we needed it. We think others need it too.

And can it run DOOM? Of course.