Adding a library takes seconds. Owning it takes years - upgrades, breaking changes, security advisories, and the day it is abandoned. We are not against dependencies. We are against unexamined ones.
How much of it do we actually use?
If we need one function from a package with forty, we usually write the function. A date-formatting helper is not worth a transitive tree.
What does it drag in?
Check the dependency tree, not just the package. A small library with thirty transitive dependencies is not a small library.
Is it alive?
- When was the last release, and the last merged fix?
- How many open issues have no reply?
- Is it one person, and what happens if they stop?
What is the exit?
If this is abandoned in two years, how hard is it to replace? Anything touching auth, payments or data storage gets this question in writing before it goes in.
