The real cost of adding a dependency
Kilobytes are the cheapest part. The expensive part arrives eighteen months later, on a Friday.
The bundle cost of a dependency is the one thing everybody measures and the smallest thing on the list. What actually costs is the upgrade you cannot do because a transitive dependency pinned something, and the security advisory that arrives when nobody remembers why the package is there.
Key takeaways
- Write down why you added it, in the commit that adds it.
- Prefer the one with fewer dependencies of its own, even if it is bigger.
- For anything under about fifty lines, copy the code and own it.