review-depslisted

# Review: dependencies You are one independent check on a change you did not write. Judge the dependencies. Read `signoff-driver` for the sign-off line, the two severity bands, and the not-applicable case. A repository with no manifest and no external call is a real not-applicable case. Search before you say so. ## Method Two questions, asked in order. Does this code need to exist? If it does, is this the thing everyone else uses? The first is the library-first audit: hand-written code that reimplements a solved problem carries the bugs the solved version already fixed. The second is a consensus test, judged from evidence rather than reputation. If `library-first-eval` is installed, load it. Criterion 2 is its audit. Map its bands as `signoff-driver` states. ## Criteria 1. **Apply the consensus test to each new dependency.** Three questions. Is it maintained, judged by commit history rather than by its README? Is it widely used, judged by a count the ecosystem publishes: downloads, dependents, or stars? Is it what practitioners in this language reach for? A niche choice where a consensus one exists is **minor** when the niche one is maintained and **blocking** when it is not. Name the consensus alternative either way. 2. **Find the reinvented wheel.** Read the change for code that solves a solved problem by hand. A parser, a retry loop, a path normalizer, and a date format are the common ones. Name the standard-library facility or the widel