Every modern project starts the same way: a manifest, an install command, and a few hundred packages nobody on the team has read. Zero Dependency 2026 removed that step. For 72 hours, from August 28 to 31, teams had one rule: ship something genuinely useful with an empty dependency manifest. No crates, no npm packages, no go.sum. Only the standard library of the language they picked.
295 projects were submitted and judged. The strongest teams did more than avoid packages. They rewrote the ones everybody installs, then proved the replacements behave. The leading submissions scored above 4.6 out of 5.
What participants built
First place went to zql from Team Rocket, a read-only SQL engine on the Rust standard library. Point it at a folder of CSV and SQLite files and query it over the wire. The decision that set it apart was speaking the PostgreSQL v3 wire protocol, so existing psql and Node clients connect to it unmodified. It shipped with 295 passing tests, a dependency tree of a single node, and a differential test suite that checks its answers against SQLite itself. Final score: 4.79.
Second place, Stranger from Cause Of Death, reads your lockfile and tells you which dependencies you have never actually met: hallucinated package names, code that runs at install time, the same package sitting in your tree at four different versions. It is a supply-chain tool built with no supply chain. Judges singled out its evidence: differential testing against CPython's json module, and an ablation that measured one of its design choices instead of asserting it. Final score: 4.76.
Third place, Revenant from Strata, is a SQLite engine written from scratch in Rust with no crates, no C library and no unsafe code, in a language that cannot read a SQLite file today without linking C. The strongest check was interoperability. Reading a SQLite file is useful; writing a database that SQLite itself can then open and modify is far harder to fake. Final score: 4.67.
The Package Killer award went to zdh from The Goated Duo, an HTTP/2 server on the Go standard library that replaces golang.org/x/net/http2 and its HPACK package outright. All ten frame types, hand-built Huffman tables, flow control and stream state, running over raw TCP with no net/http underneath.
Behind the podium sat an Excellence tier that would have won most hackathons. Needle from hollanov is a full-text search engine in pure Go, with its own tokenizer, stemming and ranked search, and a write-ahead log that treats a torn tail as an expected crash shape. Hollow is a recursive DNS resolver that walks the root servers itself, with bailiwick checking and DNS 0x20 randomisation. strata decodes git objects, packfiles, delta chains and zlib by hand and matches git on a real 994-commit repository. bindery turns a folder of Markdown into a documentation site with search and a from-scratch WebSocket for live reload. Vouchsafe from Neural Knights replaces the entire dependency stack behind passkey login, including the CBOR and COSE library every Go WebAuthn package leans on.
The write-ups
A Write-Up Side Quest asked participants to document what the constraint taught them. The winners treated failure as the content. Sai Ram Dash replaced eleven everyday npm packages and ran 856,168 differential checks against the originals, and ended up testing the package being replaced when semver's intersects() gave opposite answers on swapped arguments. Pal Ghevariya built the JSONTestSuite harness before writing the parser, watched 19 of 47 must-reject number fixtures slip through Rust's f64::from_str, and wrote a number state machine by hand in response. Daniel Amah described fifty passing tests and a round-trip decoder that stayed green over two real QR encoding defects, and explained honestly why the tests were blind to them.
How the panel judged
Submissions were scored on four published criteria: Functionality and Usefulness (35%), Zero-Dependency Craft (30%), Code Quality and Idiom (25%) and Innovation (10%). The panel drew on engineers from Apple, Google, Meta, Microsoft, Amazon Web Services, IBM, Uber and Expedia Group.
Mikita Hrybaleu, CTO at Zendrop, reviewed two full batches and rewarded proof over claims, crediting teams that ran their parsers against a reference implementation and wrote down what their checks could not prove. Sergei Illarionov, Senior Data Engineer and team lead at Fidelity National Financial, also covered two batches and re-ran test suites rather than trusting the README, holding storage engines to crash and fuzz tests against a reference model. Rushikesh Hayatnagarkar, Senior Product Manager at Amazon, judged usefulness first and spotted the bit-level craft in zdh that later earned it the Package Killer award. Oleksandr Moskalenko, Lead Software Engineer at Lennar, brought a working knowledge of what each runtime's standard library covers natively, which is exactly what the Zero-Dependency Craft criterion asks. Surabhi Boob, Senior Software Engineer at Microsoft working on Azure virtual networking, wrote the review that summed up the winner: leverage, backed by tests.
What the constraint showed
The empty manifest turned out to be a test of honesty more than cleverness. Teams that did well did not hide the cost of going without packages. They disclosed where a language forced a shell-out, wrote a STDLIB.md that named every package they replaced and what they gave up doing it, and built tools that check the manifest on every build instead of claiming it once. Judges checked those claims, down to counting unwrap() calls in a winner's hot paths, and vendoring source to fake an empty manifest was penalised.
The full results, every judge comment and all participant write-ups are on the event recap.
.jpg)