130+ transitive dependencies

Wow! 
Are they all needed for every use case?
Maybe some could be optional and users add them themselves if they want to use a certain functionaility?
What if one of them gets a Log4j-type vulnerability?
