Personally I came from a C background so I tended to use deps more sparingly.

In the end it's a bit of a balancing act—lots of dependencies is a larger opportunity for these kind of supply chain attacks to affect you. Copying stuff into your repo protects you from that, but it also makes it way more likely that you'll miss security fixes, unless you're actively looking for them. Re-implementing what you need is also viable but it slows down the dev process.

Although I suppose that's still doing a lot of shenanigans at compile time. It could be sandboxed pretty well (theoretically). I'd hate to give it up completely though, getting a compile time error when SELECT query params or return values have type mismatches is extremely nice.

Certainly having a larger stdlib helps Go projects keep their deps down, but I don't think it's the real reason.

Or, if you get nerd-sniped by the question and spend some time figuring it out, that’s fine too.

But if you want to be helpful but don’t want to take the time to figure it out yourself, don’t just forward the question to AI or send me a link to the first result in Google because I could have done that myself(and may have done it already). Just say you don’t know, which is a paradoxically more useful response.