Comment by rectang

I care less about the quality of the dependencies than about the burden of protecting against supply chain attacks when there are a lot of dependencies.