Consider dropping tiny dependencies

[dapplion]

💥 Proposal

Every NPM dependency introduces a security risk where we must trust that the current (and future) maintainers will not inadvertently introduce hazards to Aragon CLI users. Since this code can potentially manage value, it's worth considering the risk. Past NPM dependency attacks have targetted poorly maintained packages with a lot of users, but the next target could be smaller packages.

Below is a list of packages that are so simple that they could be implemented locally or at least force a specific version.

• "git-clone": "^0.1.0": 1-5 lines of code
• "dev-null": "^0.1.1": ~10 lines of code
• "go-platform": "^1.0.0": ~10 lines of code
• "get-folder-size": "^2.0.1": Could be removed, IPFS has an API endpoint ot check the repo size
• "engine-check": review too

---

Also, note that the legacy and new IPFS clients are dependencies.

"ipfs-api": "^26.1.2",
"ipfs-http-client": "^39.0.2",

[sohkai]

Yes, highly highly agreed on both!

[kernelwhisperer]

Same can be said about engine-check.

[dapplion]

Same can be said about engine-check.

Good catch! Adding it