Adding a dependency is a one-line change in the diff and a long-term obligation in practice. We now stop and ask the same short list of questions before it goes in, regardless of how small the package looks.
The questions
- What does it save us, specifically? — not "it's useful", but the actual weeks of work it replaces. If the answer is vague, the dependency is probably solving a problem we don't have yet.
- Who maintains it, and how recently? — a package with one maintainer and no commits in two years is a liability wearing the costume of a convenience.
- What does it pull in with it? — a small package with forty transitive dependencies is not a small package. We look at the tree, not the name.
- What happens if it disappears? — some packages are trivial to replace and some are load-bearing for the whole architecture. That distinction should be known before the decision, not discovered during an incident.
Why this applies to model APIs too
A third-party model provider is a dependency with all the same properties — a team we don't control, a roadmap we don't set, a pricing page that can change — plus a few of its own: nondeterministic output, and a cost that scales with usage rather than staying flat. We ask an additional question for these specifically: what does a change in the provider's output distribution do to our product, and would we notice.
The conversation this replaces
Without this list, the decision to add a dependency happens implicitly, buried in a pull request, and gets approved because reviewing it properly takes longer than the change itself looks like it deserves. Making it an explicit five-minute conversation before the code is written is faster in aggregate, because it catches the expensive cases before they are embedded in a diff someone has to defend in review.
A dependency you did not choose deliberately is a dependency you inherited by accident. Both cost the same to maintain.
What this has stopped, concretely
A date-formatting library that pulled in a full internationalisation framework for a single format string. A queue package unmaintained for three years, chosen because a tutorial used it. Neither was a dramatic save, and both would have been mildly annoying for years if nobody had asked the second question.
The habit underneath this
Every dependency is a decision the team will have to live with long after whoever added it has moved to another project. Treating it as a decision, briefly and explicitly, is cheaper than treating it as a detail and finding out later that it wasn't one.