The Hidden Costs of Micro-Dependencies
Cover photo by Chris Ried on Unsplash
I’m convinced that installing a package for every single trivial utility function is a trap. If you are pulling in a library just to check if a value is an array or to pad a string, you are adding weight to your project that you don’t need. It’s sloppy.
Why do we do this?
It feels productive to run npm install is-odd. It solves the problem in seconds. But you aren’t just getting that function. You are getting a dependency tree that you now have to track, audit, and secure. Even if these packages are tiny, they add up to a massive attack surface. Sometimes the dependency of your dependency has a security vulnerability (or just poor maintenance practices) that breaks your build at 3 AM.
The real cost
Think about the weight. When you add a package, you add code to your node_modules folder, your lock file, and eventually your bundle. You might say, “But my bundler handles tree shaking so it doesn’t matter.” That’s fair (and true for most modern setups), but it ignores the cognitive load. I’ve spent hours debugging build issues that turned out to be a misconfigured sub-dependency deep in the tree. It’s rarely worth it.
Just write the function
Here is a simple example. Instead of installing a library for string truncation, just write it yourself.
function truncate(str, length) { return str.length > length ? str.substring(0, length) + '...' : str;}It takes ten seconds to write. It is tested code that exists inside your own codebase. You own it. You understand it.
What about complex logic?
“But surely I should use a library for date parsing or complex math?” I agree. I’m not suggesting you reinvent the wheel for things like heavy data processing or cryptographic standards. Use a battle-tested library for the hard stuff. For the trivial stuff, avoid the extra layer.
It is about control
When you own your code, you don’t have to worry about a maintainer deleting their project or introducing a breaking change in a minor patch. I prefer spending a few minutes writing a utility over an hour fixing a broken build because a sub-dependency changed. Does your project really need fifty extra dependencies to do basic string manipulation? I suspect it doesn’t.