I was talking about total deps, not direct. By installing something like Celery, you get 8-10 extra dependencies that, in turn, can also have extra deps. And yeah, extra deps can conflict with each other as well.

> You just keep up as you go

He said "Updating a project that was started 5-6 years ago takes a lot of time."

Not much work every few months turns into a lot over years, especially if you skip a few of those "every few months" events.

I'm confused. It's too much work to upgrade dependencies, but not too much time to write from scratch and maintain, in perpetuity, original code?

Yes. I've probably spent more time maintaining a trivial Rails app originally written in 2007 than I spent writing it in the first place.

But if you would have rewritten the entire app every time you needed to update the dependencies, that would have taken even more time.

That is obviously true but doesn't mean as much as you seem to think. Washing laundry is also not much work but it adds up to a lot over the years, especially if you skip a few weeks of laundry every once in a while. That is not an excuse to not do it.

The answer is the same in both cases: acquire some discipline and treat maintenance with the respect it deserves.

It is easy, and people tend to do what is easy. It takes more effort to minimise dependencies. Your boss or your client will not even notice.

Obviously there are some dependencies that you cannot easily avoid (like the things you mention). On the other hand there is a lot off stuff used that is not that hard to avoid - things like wrappers for REST APIs are often not really necessary.