Rust suffers from the same faults as the JS ecosystem. Any significant crate imports hundreds if not thousands of dependencies. The probability that one of the authors gets targeted by AI-assisted attacks is just too high.

Also most of these dependencies provide a breadth of features that the end package does probably not need.

▲

dwroberts an hour ago | parent | next [-]

My experience has been that it has a major advantage, in that freeze + offline actually work properly. You can collect the dependencies you need once, put them in version control and never ever talk to remote registry again

▲

quikoa an hour ago | parent | prev | next [-]

A language without a large stdlib pushes this that functionality into (transitive) dependencies. I hope more language will adopt batteries included approach.

	▲	thayne 19 minutes ago \| parent [-]
		No stdlib will ever include all the "batteries" you need. And large stdlibs have their own set of problems, like stagnation, tying the library version to the language version, backwards compatibility garantees preventing evolution, and either needing a wide range of domain experts to maintain it, or having developers maintain components they don't have a deep understanding of. I think the sweet spot is having an ecosystem of "blessed" libraries that are reviewed for security and quality, but are versioned independently of the language, and maintained by subject matter experts.

▲

account42 an hour ago | parent | prev [-]

Yes, the lack of a language package manager for older programming languages is a feature.