@nota@chaos.social thousands is way overblown for most projects, but yeah, if it's security critical, you audit your dependencies. which tends to be a whole lot easier when they're all small as opposed to big kitchensink frameworks