No bloated dependencies

Every runtime dependency you ship is inherited by every consumer. lodash (full) adds ~72KB minified; moment adds ~230KB. A focused SDK with full lodash as a runtime dependency imposes that weight on every browser bundle that installs it — directly increasing page load times and Lighthouse performance scores for users who never touch the offending methods. ISO 25010 resource-utilization flags this; SLSA L1 supply chain concerns apply because each runtime dependency is an additional attack surface. CWE-1357 covers use of unnecessarily broad software components.

Audit runtime dependencies and replace heavy packages with built-in alternatives or lighter substitutes.

// Before — heavy runtime deps:
{
  "dependencies": {
    "lodash": "^4.17.0",
    "axios": "^1.0.0",
    "moment": "^2.29.0"
  }
}

// After — zero runtime deps:
{
  "dependencies": {}
}

// Replace lodash.get with optional chaining:
// Before: _.get(obj, 'a.b.c', defaultVal)
// After:  obj?.a?.b?.c ?? defaultVal

// Replace axios with built-in fetch (Node 18+):
// Before: const { data } = await axios.get(url)
// After:  const data = await fetch(url).then(r => r.json())

Run npx bundlephobia-cli <package-name> before adding any new runtime dependency. Target: published package under 500KB gzipped.