Vendor your dependencies

• Fewer dependencies = better software.

Package managers

• Lots of worms lately.
• Need the internet to build.
• Pulling from a registry all the time invites supply chain attacks.

Vendoring

• No internet needed to build.
• Safe from supply chain attacks.
• The code lives in your repo, so you actually read it.
• You understand the code you didn't build.
• It makes you take dependencies seriously.

• I'm not fully there yet. Still moving my projects towards fully embodying this.