I work on a ~9y old nodejs codebase, have none of those issues, we have 8 dependencies, this is fully resolved tree. One to generate zip files, one for markdown parsing, connecting to postgres, etc... most of them have no sub dependencies. We always reach out first to what nodejs lib have, try to glue ourself small specific piece of code when needed. The app is very stable and we have very few frustrations I used to…
What do you use for testing? Built-in test runner?
I have a few projects that use mocha, and I recently noticed that several vulnerabilities come from its transitive dependencies, and there is no easy fix today. The project hasn't seen updates for a while. Makes me wonder if I should just ditch mocha completely.