Ok, so I created an empty cargo project and added serde_json, regex, walkdir and rand. This added 28 crates, several of these from the same authors.
If the absence of these features caused 1000s of dependencies, then where are the remaining 972?
When I look at a project at work then what inflates the dependency tree is a combination of a whole webserver application stack plus SDKs consisting of dozens of crates. Those then pull in an async runtime or two, different HTTP clients, dozens of crypto crates and so on.
The crate count is a poor metric anyway since some subtree of dependencies is often provided by a single organization.
And I find it quite questionable that everything that's needed for an enterprise grade webserver stack should be part of the standard library, not even Java has that.
Relatedly, cryptographers have failed to come up with a proven set of primitives, what's standard changes every few years.
Four. Though you initially asked for five features, so let me add lexopt, which brings the number up to 29.
> That's why projects end up with 100s of crates, sometimes 1000s.
If your argument is "out of 1000s of dependencies 29 could be easily removed" then it does sound a lot less of a deceive change when it comes to supply chain security.
And even getting those 29 right is hard. For example people do want regular expressions with lookaround assertions, but most implementations suffer from runtime blowups (resulting in ReDoS attacks) and improving on that is a fairly recent research[0], so this is hardly a trivial and settled thing to implement. So often there's a tradeoff between choosing more powerful regular expressions and DoS-resistant ones, not one standard.
If the absence of these features caused 1000s of dependencies, then where are the remaining 972?
When I look at a project at work then what inflates the dependency tree is a combination of a whole webserver application stack plus SDKs consisting of dozens of crates. Those then pull in an async runtime or two, different HTTP clients, dozens of crypto crates and so on.
The crate count is a poor metric anyway since some subtree of dependencies is often provided by a single organization.
And I find it quite questionable that everything that's needed for an enterprise grade webserver stack should be part of the standard library, not even Java has that. Relatedly, cryptographers have failed to come up with a proven set of primitives, what's standard changes every few years.