Zero Dependencies Is Not a Slogan

August 21, 2026 · 4 min read

Most JavaScript projects start with npm install. NeoDonkey does not. Its package.json has no dependencies field. There is no node_modules folder. There is no lockfile. This is not minimalism for its own sake. It is a structural commitment that affects every architectural decision.

The Dependency Trap

A typical Node.js project in 2026 has 1,000+ transitive dependencies. Each one is a point of failure:

• A maintainer gets burned out and stops updating
• A security vulnerability is discovered in a package five levels deep
• A license change makes the package commercially unusable
• An "upgrade" breaks your build because of a minor version bump
• The package is abandoned and archived on GitHub

When your ERP depends on 1,000 packages, you do not own your ERP. You rent it from a thousand strangers, and any one of them can break your business with a single commit.

What Zero Dependencies Means

NeoDonkey's runtime is pure JavaScript that uses only Web API primitives:

• WebCrypto for Ed25519 signatures, X25519 encryption, AES-GCM, HKDF
• IndexedDB for persistent key storage in the browser
• OPFS for filesystem access in the browser
• WebRTC for peer-to-peer sync between devices
• Fetch API for HTTP requests

There is no Express, no React, no Lodash, no Axios. There is no build step that bundles 50MB of JavaScript. The entire ERP runtime is under 200KB of source code.

The Trade-offs

This choice has real costs. We do not get:

• Automatic React reconciliation (we write our own DOM updates)
• Express middleware ecosystem (we write our own HTTP handlers)
• Lodash utilities (we write our own array and object helpers)
• TypeORM or Prisma (we use git as our database)

But we also do not get:

• Supply chain attacks via compromised dependencies
• Breaking changes from upstream maintainers
• License conflicts in transitive dependencies
• 200MB Docker images just to run an ERP
• Vulnerability scanners yelling about packages we do not even use

Where the Code Lives

Every module in NeoDonkey is self-contained:

• runtime/git/repo.js — Pure JavaScript git implementation (no child_process.spawn('git'))
• runtime/identity/ed25519.js — Key generation and SSH signatures via WebCrypto
• runtime/crypto/keys.js — Encryption using only WebCrypto primitives
• runtime/money/money.js — BigInt-based exact decimal arithmetic
• runtime/export/datev-extf.js — DATEV serializer, zero external packages
• runtime/export/xrechnung.js — XML generator, zero external packages

What This Means for Your Business

When you deploy NeoDonkey, you deploy 200KB of JavaScript that you can read in an afternoon. There are no hidden dependencies. There is no npm audit output that spans three screens. There is no surprise breaking change on a Tuesday morning because someone in California renamed a function.

Your ERP is yours. Every line of it. And that is only possible because we decided, at the beginning, that there would be no dependencies field in package.json.

NeoDonkey is an open-source ERP with zero dependencies. It runs in your browser, stores data in git, and exports to DATEV and XRechnung. Try the demo.