[jart]

Check out Cosmopolitan which vendors all its dependencies. https://github.com/jart/cosmopolitan You can't use Node with it, yet, but you can use QuickJS if you `make o//third_party/quickjs/qjs.com` and `o/third_party/quickjs/qjs.com -m third_party/quickjs/repl.js`. Cosmopolitan goes so far with vendoring dependencies that it actually has its own C library implementation that prevents functions like socket(), connect(), and getaddrinfo() from talking to the Internet if the software is running under GNU Make. Since sometimes we've found when porting software it'll have unit tests that do sneak leaks to public servers. It goes without saying that in order to make it even possible to vendor all dependencies, down to the binary level, there's a very long list of topologically ordered things that need to happen before you can even talk to the Internet. https://github.com/jart/cosmopolitan/blob/50937be7524197f23a... It's all cross platform and native at the same time for CLI/TUI. It'd surely make a more trustworthy tooling stack for a password manager than something like Electron since the temptation for people to incorporate things like FullStory into such GUIs is too great.