The parent’s grievance isn’t that projects have dependencies, but rather that projects advertise only the dependencies which Cargo doesn’t manage, which can cause confusion (the project maintainer wants to communicate that these are the only externally-managed dependencies, but at least some readers interpret this as a comprehensive list of dependencies). I’m only clarifying, not arguing in favor of the parent’s perspective.

> Do you audit the HUGE source code of the most vulnerable application you use, your web browser? It's a huge moving target with insane complexity. Didn't think so.

No, I do not. Relevance?

> Do you audit the source code of the compilers used to build your CPU?

No, I do not. Relevance?

> Instead of avoiding dependencies,

I never said anything about "avoiding dependencies". Are you in the wrong discussion?

> dependencies should be locked for a release cycle and audited with automated tools to instill confidence.

Personal preference, open to debate.