CVEs might not be the best metric, alone.

Many large, mature, and solid packages could have long histories of resolved CVEs.

No, I prefer to find and vendor in single libraries which do not come with 15M lines of code. Like Eigen.

On the other hand, you can introduce Qt modularly, so you don't have to import all of them. Same for Boost, though I don't use either.

I write Go and use Uber's zap for logging. It pulls in uncomfortable amount of code, too. Until I can find something better, I'll continue using it, but I'm not comfortable with it.

However, in C++ land, I was able to use standalone libraries like Catch or Eigen which were big, but not unwieldy, and Eigen is also as modular as Boost. So you know what you include and what you do at the end of the day.

I'm a big fan of standalone source code repositories which vendor minimum number of libraries (which I strive to develop, too). You need GCC and glibc only. Just make it, use it. "No hidden fees, no games", I may say.

Which also shows the issue with using size as the only metric.

Boost and Qt are very solid systems. They have well-deserved, excellent reputations. In order for this tool to be useful, it would need to have a “reputation score,” that relies on more than GH stars and social media buzz.

That said, I am not a fan of doing something like adding 1MB to a page load, so you can animate a button press; even if the dependency is reputable.

Sometimes, it makes more sense to reinvent the wheel, as opposed to bringing in an 18-wheeler.

Yes.

Even ignoring the fact that no one forces you to add whole Qt to your project, do not compare Qt, which is a battle-tested, long-lived framework, developed and maintained for decades by the company that also provides commercial support for it, with a bucket of intermingled crap sourced from random repositories across the internet.

BTW: Most compiled languages have good linkers and postprocessors. They strip out unused executable.

The compile might take a while, but the resulting binary may not be as big as you think.

This does not apply, however, to interpreted languages, like JS.

Not sure about "JIT" languages, though, like Python and PHP.

True, Python has a larger std lib, but Node.js has increased a lot in the last two years.

Although it’s not so much Python that’s influencing Node.js but more like Deno and Bun that try to include everything but the kitchen sink.

If you code mindfully, Python stdlib can do tons and tons of things (I love logging and argparse, for example). But I have seen the other end of the spectrum, too. Somebody imported whole Pandas just to read a couple of columns from an Excel file, to create a simple URL list, and some folders.

To download the free Springer books during COVID.

I mean, ouch.

P.S.: If you like your eyes, please don't look at AI stacks.