How long is this kind of shit going to go on before we start having a serious conversation about making “limit dependencies” a widely-agreed-upon fundamental security practice? Right along with “validate your inputs” and “encrypt sensitive data” and such.