The Dependency Problem

• Supply chain attacks (log4j, xz)
• Left-pad incidents
• Version hell
• Audit impossibility
• Legal compliance issues

Solutions

• Vendor critical code
• Reimplement trivial functions
• Use standard libraries
• Static linking
• Subresource integrity

Policy

Zero runtime dependencies. Build-time tools must be auditable. Every dependency requires justification.