It’s not so much “But that’s not how you build stable software.” It’s more like “But that’s not how you build software [at all today].” Modern software is powered by loads of shared packages, that’s just how all modern languages work. This is equally true for Rust and Python.
You’re not wrong - all libraries with automated dependency packaging do have this problem. But you’re downplaying the scale by a lot. Javascript dependency graphs are absolutely massive. Python has a decent standard library that reduces the number of shared packages by quite a bit. There are definitely downsides to having a large standard library like Python has, but it does significantly reduce the probability of a supply chain attack compared to Javascript.
I can’t comment on Rust personally, since I don’t have much experience with the ecosystem.
You’re not wrong - all libraries with automated dependency packaging do have this problem. But you’re downplaying the scale by a lot. Javascript dependency graphs are absolutely massive. Python has a decent standard library that reduces the number of shared packages by quite a bit. There are definitely downsides to having a large standard library like Python has, but it does significantly reduce the probability of a supply chain attack compared to Javascript.
I can’t comment on Rust personally, since I don’t have much experience with the ecosystem.