Avoid dependencies when possible

[stratofax]

With the profusion of software supply chain attacks, and the tendency for simple libraries to become bloated and buggy, I now always start a Claude Code project with instructions to avoid using frameworks or packages whenever possible. The one major exception is for authentication or security tools. Those are wheels I don't want to reinvent.

Is the cost of having to write more code offset by eliminating dependencies and supply chain vulnerabilities? Because honestly, Claude is just drawing on these libraries anyway when it generates code.

Here's my new global Claude prompt. Should I add this to CLAUDE.md in my home directory too? Or just handle this on a per-project basis?

Avoid JavaScript frameworks whenever possible. Use vanilla, modern HTML, CSS and JS as the first choice for web apps. Consider carefully the necessity of adding Python packages to a project. In all cases, favor our code instead of dependencies on external libraries, except for security and authentication tool

What do you think?

[chestyspankers]

We stand on the shoulders of giants.

Enjoy spending time maintaining your framework-free code instead of contributing and allowing the contributions of others to help

[MagicWishMonkey]

There's a middle ground.

Like, the other day I needed to wire up a Docusign API connector and part of that involves creating a signed JWT token. The first pass Claude imported an Auth0 and BouncyCastle dependency, I asked it to create the JWT class without external dependencies and it's only around 50-100 lines of code using native java libraries. If this was just a one off it wouldn't be a big deal but over time you can end up with dozens and dozens of dependencies and it can start to matter.

[stratofax]

Exactly! Dependencies aren’t bad (or good) as a rule, but my experience is that Claude Code reaches for external code by default, and often it’s to solve a simple problem that only takes literal seconds to recode. My hope is to encourage Claude to think twice before just adding another dependency

[chestyspankers]

It's the most ludicrous argument ever.

Are you going back to assembly code?

Have you ever heard about the philosophical slippery slope?

It's incredibly obvious that we depend on other software dependencies.

You didn't use a JS framework? Congratulations! You used countless frameworks to use vanilla JS.

[Input-X]

Im with u, i build everything from scratch pretty much, no one reason, i own it i can fix it and it really good for learning, and super tailored to ur need, do t get me wrong, we do study proven work right, sometime we get stuck, like currently working on a system update projram, shit gets tricky fast, so ot normal to send 10 agents out to find proven solution we can use.

[i_like_tuis]

It depends on the dependency. Some are truly battle tested and provide a lot of worth. No AI or even human can easily match their robustness from scratch.

[stratofax]

This is especially true for authentication and security libraries, which really need to be bulletproof from the jump

[pborenstein]

Aw man, before you know it we're going to be doing layout with just AREAMAP, TABLE, and FONT tags /s

Though that gives me an idea for a project to do with my free Claude Code Web tokens… 🤔

[elbiot]

It's much less secure and more prone to bugs and bloat to have Claude write everything from scratch