Less external dependencies. I noticed Claude was vendoring (copy-pasting) Lucide icon svgs into my codebase (with proper attribution) because I was only using a small handful of them. That's awesome.

▲

packetlost 2 hours ago | parent | next [-]

Except when it's a license violation or in something that ends up having a security vulnerability.

▲

nonethewiser 2 hours ago | parent [-]

>Except when it's a license violation or in something that ends up having a security vulnerability.

What's more secure isn't so simple. If you vendor something with a vulnerability then it wont be patched. But vendoring may also mean you took the 2% of the library you need and not the 98% which reduces the surface area for vulnerabilities. And it can cut the other way - you may update a package that was previously good and is now vulnerable (regressions, supply chain attacks).

There is a balance that must be struck, and I think LLM's strike a better balance than people do. Dependencies are a convenience with a cost and LLM's can trivially copy or re-implement things that we cant.

	▲	packetlost an hour ago \| parent [-]
		> But vendoring may also mean you took the 2% of the library you need and not the 98% which reduces the surface area for vulnerabilities If you aren't using a library function you're not vulnerable to exploits in that code: unused but imported code is inert (possible usable as a gadget if you're vulnerable elsewhere, but at that point you're screwed anyways) and most compilers/runtimes completely eliminate it. > you may update a package that was previously good and is now vulnerable (regressions, supply chain attacks) There are better mitigations to this than not using a library. You still completely ignore the license violations.

▲

gavinray 2 hours ago | parent | prev [-]

Great for static assets, potentially not-so-great for "load bearing" ;^) code

▲

andai 2 hours ago | parent | next [-]

Every time I try to get a npm based project running (or one of my forks of one), half the packages don't exist anymore or I need to spend hours fixing breaking changes.

It's usually more straightforward to just rebuild it from scratch — not to mention infinitely more satisfying — and that was true before AI!

	▲	gavinray 2 hours ago \| parent [-]
		Language ecosystems tend to exist on a continuum. I love TypeScript but dread the dependency management because it's so often bit-rotted. On the other hand, I routinely build Java/JVM projects with dependencies that haven't been updated in a decade that compile without issues. Somewhere in the middle are most languages, I think.

▲

nonethewiser 2 hours ago | parent | prev [-]

Yes it does depend on the dependency, and a static asset is on one end of the extreme.

It depends on the "load bearing" code. Obviously something like crypto is not something we should implement ourselves but core business logic would be "load bearing" in another way and is probably not something you want to farm out to a dependency.