one of my problems is i'm very hesitant to add new dependencies. i'd prefer to write a few pages of code myself than depend on an external library. or use one that's small. at least i understand it then.

but your own code is also a liability! you probably did it wrong.

that nice, tiny, single-file dependency that replaces a huge, well-known library? it's someone's weekend project. it's not well-tested. it has a buffer overflow vulnerability in it. it didn't need to be attacked, it was faulty to begin with. you didn't actually understand it.

i don't have the answers, sorry.