My app has 9 runtime dependencies

React 18 + Vite 7 + TypeScript + Tailwind, Supabase for Postgres and auth, Edge Functions on Deno. That's the whole thing.

What's deliberately absent, and what replaced it:

• No component library. Tailwind plus a small set of local primitives. The tradeoff is real: I hand-rolled focus management and I've paid for it. What I got back is that a contrast gate can prove the four ink steps are correct, and a second check bans opacity-modified text colours like text-charcoal/40 — which rendered at 2.40:1, under even the 3:1 large-text floor. Alpha applied at the call site is invisible to a token-level check by construction. You can't write that guard against someone else's theme system.

• No state manager. TanStack Query is the cache; server state is the only state that matters here. Nothing has needed Redux or Zustand.

• No ORM. Postgres functions called as RPCs. The cost is that Supabase takes an RPC name as a free string, so a typo compiles and fails at runtime as a 404. So there's a coverage ratchet on it: of the 246 RPC names the browser reaches, 46 had neither generated types nor a contract. The gate caps that list and fails when a 47th appears.

• No form library, no date library.

Two honest concessions. pdfjs-dist and pptxgenjs are heavy, and they're there because clients get PDFs and decks. And there are about 40 devDependencies, so this is a claim about what ships to a browser, not about my node_modules.

The npm audit gate is the one place I'd push back on conventional advice. A bare audit gate is unusable the first time an advisory ships with no patched version: it goes permanently red, and npm audit fix --force "resolves" it by downgrading you into older CVEs. Mine fails on any unreviewed moderate-or-higher advisory, and also fails when a written exception expires or outlives its advisory.

Lean deps aren't a virtue on their own. What they buy is the ability to write checks about your own code, because you own the layer the check would inspect.