0deps Movement Proposes Vendoring All Dependencies to Cut Supply Chain Risk

The 0deps Movement advocates for eliminating dynamic external dependencies by embedding all required libraries directly into a project's repository at clone time. The approach aims to reduce software supply chain attack surfaces, enable reproducible builds, and centralise security auditing within teams. A core principle of the model is that public interfaces — the contracts between libraries and applications — remain stable even as underlying implementations are updated or rewritten. This separation means security patches can be applied internally without breaking application code or requiring downstream changes. Proponents argue the model gives development teams greater control over the code running in production compared to relying on hundreds of third-party contributors.