Zero Dependency 2026 โ€” Ship Something Useful With an Empty Manifest

๐Ÿ†๐Ÿ…ด๐Ÿ†‚๐Ÿ†„๐Ÿ…ป๐Ÿ†ƒ๐Ÿ†‚

Zero Dependency 2026 ran August 28 to 31, 2026, a 72-hour online sprint with one rule: ship something genuinely useful with an empty dependency manifest. No crates, no npm packages, no go.sum. Just the standard library of whatever language you chose. 295 projects were submitted and judged, and the teams at the top did not merely avoid packages, they rewrote the ones everybody installs and then proved the replacements behave. The leading submissions scored above 4.6/5.00.

โœฏ Grand Prize Winners

  • 1st Place โ€” zql (Team: Team Rocket). A read-only SQL engine written against the Rust standard library, pointed at any folder of CSV and SQLite files and queried over the wire. Final score: 4.79/5.00. "Speaking the PostgreSQL v3 wire protocol so existing psql and Node clients connect unmodified is the strongest leverage decision, and it's backed by 295 passing tests, cargo tree at a single node, and a differential SQLite oracle suite no one else attempted." โ€” Surabhi Boob, Judge
  • 2nd Place โ€” Stranger (Team: Cause Of Death). Reads your lockfile and tells you which dependencies you have never actually met: hallucinated package names, code that runs at install time, the same package sitting in your tree at four different versions. Final score: 4.76/5.00. "Exceptional discipline โ€” differential testing against CPython's json and an ablation quantifying the no-parent clause instead of asserting it." โ€” Mikita Hrybaleu, Judge
  • 3rd Place โ€” Revenant (Team: Strata). A SQLite engine written from scratch in Rust with an empty dependencies table: no crates, no C library, no unsafe, in a language that cannot read a SQLite file today without linking C. Final score: 4.67/5.00. "The strongest part is interoperability. Reading a SQLite file is useful, but writing a database that SQLite can subsequently open and modify is a much stronger correctness check." โ€” Shaibal Maji, Judge

โœฏ Package Killer & Write-Up Side Quest

  • ๐Ÿ“ฆ Package Killer โ€” zdh (Team: The Goated Duo). An HTTP/2 server on the Go standard library that replaces golang.org/x/net/http2 and its HPACK package outright: all ten frame types, hand-built Huffman tables, flow control and stream state, with no net/http underneath. "Hand-rolling an RFC-compliant HTTP/2 frame processor and HPACK dynamic table compression entirely over raw TCP sockets showcases exceptional idiomatic concurrency and bit-level craft." โ€” Rushikesh Hayatnagarkar, Judge
  • โœ๏ธ Write-Up, 1st โ€” Sai Ram Dash. Replaced eleven everyday npm packages and ran 856,168 differential checks against the originals, ending up testing the package being replaced when semver's intersects() gave opposite answers on swapped arguments.
  • โœ๏ธ Write-Up, 2nd โ€” Pal Ghevariya. Built the JSONTestSuite harness before the parser, watched 19 of 47 must-reject number fixtures slip through Rust's f64::from_str, and hand-wrote a number state machine in response.
  • โœ๏ธ Write-Up, 3rd โ€” Daniel Amah. Fifty passing tests and a round-trip decoder that stayed green over two real QR encoding defects, plus an honest account of why the tests were blind to them.

โœฏ Excellence Tier

  • Needle (hollanov) โ€” A full-text search engine in pure Go: custom tokenizer, stemming, inverted index and ranked search over local files. Final score: 4.63/5.00
  • Hollow (Hollow Knight) โ€” A recursive DNS resolver, ad-blocking server and wire-level toolkit on the Go standard library alone, walking the root servers iteratively with bailiwick checking and DNS 0x20 randomisation. Final score: 4.63/5.00
  • strata (strata) โ€” Git repository archaeology with an empty manifest: loose objects, packfiles, delta chains and zlib decoded by hand, matching git on a real 994-commit repository. Final score: 4.62/5.00
  • bindery (c0nfig) โ€” Turns a folder of Markdown into a real documentation site with search, dark mode, hand-rendered diagrams and a from-scratch RFC 6455 live-reload socket. Final score: 4.57/5.00
  • Vouchsafe (Neural Knights) โ€” A WebAuthn relying-party server replacing passkey login's entire dependency stack, including the CBOR/COSE library every Go WebAuthn package leans on. Final score: 4.56/5.00

โœฏ Evaluation Panel

Submissions were assessed by a panel of engineers from Apple, Google, Meta, Microsoft, Amazon Web Services, IBM, Uber and Expedia Group, scored on the published criteria: Functionality & Usefulness (35%), Zero-Dependency Craft (30%), Code Quality & Idiom (25%), and Innovation (10%). Featured judges:

  • Mikita Hrybaleu โ€” Zendrop
  • Oleksandr Moskalenko โ€” Lennar
  • Rushikesh Hayatnagarkar
  • Sergei Illarionov
  • Dmitrii Kostriukov

โœฏ Participant Write-Ups

The standard library is not a validator: 72 hours of zero-dependency JSON in Rust, I killed toxiproxys job with zero go dependencies then the backend died on purpose, I Built C++ Test Impact Analysis With Zero Runtime Dependencies, We Deleted `pip install` From a Dev Tool. Here's Everything That Broke., TraceSieve: See What Your Program Actually Did, Building chronos what zero dependencies actually, Building YUKIโ€™s Memory Management, Fifty Green Tests, Two Real Bugs, and the Oracle One `npm install` Away, I wrote a dependency scanner with zero dependencies. The parser was easy; the terminal was not., 156 Imports, Zero Elsewhere: What It Actually Takes to Prove a Go Program Has No Dependencies, The filesystem was the part i did not want to, Mirror what if we could actually see why two runs behave differently, 765,846 Writes/Second Was a Lie: Building a Crash-Safe Key-Value Store With Only Rust's Standard Library, Everything I'd Normally npm Install: Building a Reverse Proxy From Node's Standard Library, I Built a Network Security Diagnostic Tool With Pythonโ€™s Standard Library Only, Everything Was Working Exactly As Documented. The Answer Was Still Wrong., Rebuilding Python's requests from Scratch (And What I Learned), Zero dependency, ZeroS3: Building an S3-Compatible Content-Addressed Store in One Go File - Zero Dependency Hackathon 2026 - Hackathon Raptors, My first hackathon surviving the zero dependency challenge with terminalalpha, ๐—ข๐˜ƒ๐—ฒ๐—ฟ ๐˜๐—ต๐—ฒ ๐—น๐—ฎ๐˜€๐˜ ๐—ณ๐—ฒ๐˜„ ๐—ฑ๐—ฎ๐˜†๐˜€, ๐˜„๐—ฒโ€™๐˜ƒ๐—ฒ ๐—ฏ๐—ฒ๐—ฒ๐—ป ๐—ฏ๐˜‚๐—ถ๐—น๐—ฑ๐—ถ๐—ป๐—ด ๐˜€๐—ผ๐—บ๐—ฒ๐˜๐—ต๐—ถ๐—ป๐—ด ๐˜„๐—ฒ ๐˜„๐—ฎ๐—ป๐˜๐—ฒ๐—ฑ ๐˜๐—ผ ๐˜€๐—ต๐—ฎ๐—ฟ๐—ฒ โ€” ๐—ฎ ๐˜€๐—บ๐—ฎ๐—น๐—น ๐˜€๐—ฒ๐—ฐ๐˜‚๐—ฟ๐—ถ๐˜๐˜† ๐˜๐—ผ๐—ผ๐—น ๐—ฐ๐—ฎ๐—น๐—น๐—ฒ๐—ฑ ๐—ฃ๐—ฎ๐—ฐ๐—ธ๐—ฎ๐—ด๐—ฒ๐—ฆ๐—ต๐—ถ๐—ฒ๐—น๐—ฑ๐Ÿ›ก๏ธ What started as a constraint ended up be, I Built a Security Attack Analysis Engine Without Installing a Single Runtime Package, I Wanted a Pause Built Into My Code, Not Just Permission, VaultLog: Building a Persistent Key-Value Store with Zero Dependencies, ๐Ÿš€ I Built ZeroTrace โ€” Turning Messy Logs Into Clear Answers What if you had to build a log analysis tool without installing a single Python package?, Most C++ devs reach for nlohmann/json without a second thought โ€” it, I joined a Zero-Dependency Hackathon., A Security Scanner Is Easy. Building One You Can Actually Trust Is Not., I joined a Zero-Dependency Hackathon. So I couldn't install Lucene., PyGuard โ€” Zero-dependency Python security and dependency auditing CLI., DepZero: Building a Zero-Dependency Dependency Intelligence Engine in 72 Hours, I Built a Privacy Scanner With Zero Dependencies โ€”SafeSearch, Building an AST Code Verifier Without NetworkX, GitPython, or Any Dependencies, This is how and why i wrote my own vector search engine without installing anything, The AI that hallucinated a bug into my zero dependency project, I Rebuilt Git Without Git โ€” 3,390 Lines of Python, Zero Dependencies, My Go tests never executed a line of the JavaScript they were testing, I Replaced 15 Go Packages With Nothing But the Standard Library โ€” Here's What It Actually Took, I Gave My Secret Scanner a Confidence Score โ€” Then Found a Number I Didn't Want to Publish, Killed My Own Process 300 Times to Prove ChronoVault Doesn't Lie About Durability, The Standard Library Was Already Enough: Rebuilding Taskfile in Pure Go โ€” Zero Dependency 2026 Write-Up, Built a Database from Scratch in C | Rawjet undefined, No pip install? No problem. Building RepoXray with Python's Standard Library, The Standard Library Was Already Enough: Rebuilding Taskfile in Pure Go, every-bug-was-in-a-sentence-i-had-already-written, I built playwright ai native with bun 1 4 its 93 smaller, We Built a Feature We Never Shipped โ€” And That Was the Whole Point, I Built a Crash-Safe Key-Value Store Without sqlite3 โ€” Then I Killed It, I rebuilt a persistent key value store from scratch without installing a single runtime, Codemap-Writeup, Zero Dependencies, Zero Regressions: What It Took to Build CLI-KDG from Scratch, I Built a File Organizer Without Installing a Single Package, 856,168 differential checks later: what it actually takes to delete your dependencies, Building GitPush Without the Packages I Usually Reach For, Hufflite a lightweight huffman compression app in c 23, We killed nock with 500 lines of Python stdlib โ€” and still recorded the OpenAI API, I Built a Database in Rust With Zero Dependencies (and What the Standard Library Quietly Gave Me), I Built a Search Engine With Zero Dependencies โ€” Just Python 3.14's Standard Library, I Replaced My Entire Dependency Tree With the Standard Library (And Built a Quant Database), My "reproducible" build kept returning the same hash after the code changed. That was the bug., Yash Bhardwaj on building with zero dependencies, Building Z-RevixDB Without Dependencies: What We Had to Rebuild, I hand-rolled a crash-safe database in Python, What happens when someone tells you: โ€œBuild something useful., We started LeakShield with a slightly unreasonable question: How much of a repository security tool can we build before we reach for a dependency? The answer: quite a lot. LeakShield is a localโ€ฆ | Suhani Kerkar, Building StudySift Without Third-Party Dependencies, HookAudit: Building a Supply-Chain Security Scanner Without a Supply Chain, I Built a Crash-Safe Database From Scratch Because I Wasn't Allowed to pip install Anything, What happens when you remove every python dependency we built a git analysis tool to find out, How many third-party packages does it take to build a modern developer security tool?, How do you prove you didn't do something? Two verifier scripts, one answer., Most modern web apps are 95% third-party dependencies stitched together., I Didn't Install dotenv: What Happened When We Rebuilt It From Scratch, Two Bugs Later: What It Actually Took to Replace a DNS Library, We Shipped an Optimization Our Own Benchmark Said Not To, Zero-Dependency/writeup.md at main ยท Git-Dileep/Zero-Dependency, What happens when you take away the libraries that normally make software easy?, Building ZeroDB with Java 21 Standard Library | Ganesan M posted on the topic, RepoDoctor Zero Dependency CLI Built with Node.js Standard Library | Pratham Gajbhiye posted on the topic, ๐—œ ๐˜๐—ต๐—ผ๐˜‚๐—ด๐—ต๐˜ ๐—ฏ๐˜‚๐—ถ๐—น๐—ฑ๐—ถ๐—ป๐—ด ๐—ฎ ๐˜‡๐—ฒ๐—ฟ๐—ผ-๐—ฑ๐—ฒ๐—ฝ๐—ฒ๐—ป๐—ฑ๐—ฒ๐—ป๐—ฐ๐˜† ๐˜€๐˜๐—ผ๐—ฟ๐—ฎ๐—ด๐—ฒ ๐—ฒ๐—ป๐—ด๐—ถ๐—ป๐—ฒ ๐—บ๐—ฒ๐—ฎ๐—ป๐˜ ๐—ฎ๐˜ƒ๐—ผ๐—ถ๐—ฑ๐—ถ๐—ป๐—ด pip install., DevGuard: A Zero-Dependency Security Scanner Built from Python's Standard Library, One Binary, Four Jobs, Zero Dependencies: Building zeroproxy for the Zero Dependency Hackathon, I Replaced a 461-Million-Downloads-a-Month Glob Package With One Rust File, Building llamini.cpp: a from-scratch llama.cpp core in C99, โšก High-performance, zero-dependency incremental build system & task orchestrator in pure Go stdlib by Naman Swami. Features SHA-256 caching, 0ms CAS hardlinks, DataLens: The Data Tool That Refused to pip install Anything, The Database That Tells You What It Knows, Most security tools begin somewhere from detection., What happens when youโ€™re told you canโ€™t use the libraries youโ€™d normally rely on?, Building KOS: A Journey Through Zero Dependencies (And the Bugs That Taught Me Everything), I Built a Git Safety Tool Without the Packages I Normally Depend On | Ganesh Sonawane, Building DepZero: A Zero-Dependency CLI for Node.js | Sandhya sharma posted on the topic, Zero Dependencies, 456 Tests, and One Bug All of Them Missed, Zero-Dependency Linux SysAdmin Tool in Pure Python | Hackathon Writeup, We Built a Dead Man's Switch for a Crypto Wallet - Then Broke Our Own Encryption, with Zero Dependencies, We Replaced the Entire Secrets Management Stack with Go's Standard Library, 1,750 Pluses Later: The Query That Could Kill Every Connection at Once, BlitzBroker by Team CodeBlitz. A from-scratch MQTT Broker in Rust., Signature Equality Is Not Behavioural Equality: Building a Dependency Migrator With Zero Dependencies, Before You Press Enter, Who Said Yes?, Project_Archaeologist_Documentation.pdf, This Project is being createdโ€ฆ | Shubhanshu Singh, Designing a Redaction Layer for Privacy Redactor | Prabhdeep Singh posted on the topic, 13 Attacks, 0 Vulnerabilities: Building a Security Toolkit With Zero Dependencies, ZeroVault, CodeMap, by Team Axion, We Wrote a JSON Parser from Scratch in 72 Hours to Prove We Still Could, Kavyansh Gupta on building with zero dependencies, CampusLink: A Chat Server With No Internet Needed, What, Why & How: Concepts Explained <meta content=, What Zero Dependencies Actually Meant for RepoX-Ray, NovaCPP: C++17 Web Framework Built in 72 Hours | Daksh Jain posted on the topic, When ram betrays your secrets building an encrypted zero dependency redis from scratch, Zeroxy: A zero-dependency reverse proxy server in Rust, Flora Find โ€” A Full-Text Search Engine for Your Own Files, Built Without a Single Third-Party Import., I Replaced SQLite's C Driver with 800 Lines of Pure Python Stdlib: What the Docs Don't Tell You About Raw B-Trees, 9-Byte Varints, and 48-Bit Integers

Stay tuned.

Get in Touch

โ€“

Get in Touch

โ€“

Get in Touch

โ€“

Get in Touch

โ€“

Get in Touch

โ€“

Get in Touch

โ€“

Get in Touch

โ€“

Get in Touch

โ€“

Get in Touch

โ€“

Get in Touch

โ€“

Get in Touch

โ€“

Get in Touch

โ€“