A 72-hour competition with one rule, an empty dependency manifest, asked teams to rebuild the libraries everyone installs and then prove the replacements behave. The panel judged the proof as closely as the code.
Hackathon Raptors, a UK Community Interest Company (CIC #15557917), has published the results of Zero Dependency 2026, a 72-hour engineering competition held from August 28 to 31, 2026. Teams had a single rule: ship something genuinely useful with an empty dependency manifest. No crates, no npm packages, no go.sum. Only the standard library of the language each team chose. 295 projects were submitted and judged, and the leading submissions scored above 4.6 out of 5.
The constraint was aimed at a habit that most software teams no longer notice. A modern project starts with a manifest, an install command and a few hundred packages nobody on the team has read. The average npm project carries 49 direct and 79 transitive dependencies, according to figures the organisers cited, and public registries catalogued 454,600 new malicious packages in 2025. Every one of those packages is code somebody else wrote and somebody else could compromise. Zero Dependency 2026 removed them and asked what was left.
Evaluation Framework
Submissions were scored on four published criteria: Functionality and Usefulness at 35 percent, Zero-Dependency Craft at 30 percent, Code Quality and Idiom at 25 percent, and Innovation at 10 percent. Every team also submitted a STDLIB.md, a file naming each package it would normally have installed and the standard-library feature it used instead. That file turned the constraint into something a reviewer could check. Vendoring third-party source to fake an empty manifest was penalised, and the organisers were explicit that they did not care whether participants used AI, only whether the result held up: “If the artifact can’t be defended in writing, it scores accordingly.”
Expert Panel
The panel drew on engineers from Apple, Google, Meta, Microsoft, Amazon Web Services, IBM, Uber and Expedia Group. Four senior reviewers shaped how the strongest entries were read.
Mikita Hrybaleu, Chief Technology Officer at Zendrop, runs the engineering organisation behind an e-commerce fulfilment platform serving more than 300,000 connected Shopify and Wix stores, where between 65 and 95 percent of production code is now generated and engineers spend their time supervising and reviewing it. He reviewed two full batches and rewarded proof over claims. His notes credited the teams that ran their parsers against a reference implementation and wrote down what their own checks could not prove. Of one supply-chain tool he highlighted “differential testing against CPython’s json and an ablation quantifying the no-parent clause instead of asserting it.”
Sergei Illarionov, a Senior Data Engineer and team lead at Fidelity National Financial, has spent more than four years building and scaling cloud-native data platforms on Azure, across Spark, Databricks, Snowflake and Kafka on the data side and Terraform and Ansible on the infrastructure side. He also covered two batches, and his reviews usually opened with what happened when he built and ran the code himself. He held storage engines to crash and fuzz tests against a reference model rather than trusting the README, and he valued candour about failure. “BUILDLOG.md being honest about what failed first is worth more than another feature,” he wrote of one entry.
Rushikesh Hayatnagarkar, a Senior Product Manager at Amazon, designs and scales freight logistics systems for supply-demand matching, route optimisation and capacity planning, and began his career in software development and strategic sourcing. He judged usefulness first, asking of each project what a supply chain manager asks of any vendor: what it costs to own, what happens when it fails, and whether it solves the real problem. He spotted early the bit-level craft in the HTTP/2 server that went on to win the Package Killer award. “Hand-rolling an RFC-compliant HTTP/2 frame processor and HPACK dynamic table compression entirely over raw TCP sockets showcases exceptional idiomatic concurrency and bit-level craft,” he wrote.
Oleksandr Moskalenko, a Lead Software Engineer at Lennar, works full-stack across TypeScript, Node.js, React, Next.js and Rust, leads workshops and code reviews for a team of more than 20 developers, and has spent nearly a decade trimming bloat out of web applications. He brought a working knowledge of what each runtime’s standard library already covers natively, which is exactly what the Zero-Dependency Craft criterion asked reviewers to measure. In his judge statement he named the work he wanted to see: sockets and byte buffers turned into a standalone server, command-line interfaces built without helper packages, and string processing and parsing written precisely by hand.
Top Submissions
First place went to zql from Team Rocket, a read-only SQL engine on the Rust standard library. It queries a folder of CSV and SQLite files and speaks the PostgreSQL v3 wire protocol, so existing psql and Node clients connect to it unmodified. It shipped with 295 passing tests, a dependency tree of a single node, and a differential test suite that checks its answers against SQLite itself. Final score: 4.79.
Second place went to Stranger from Cause Of Death, a tool that reads a project’s lockfile and reports the dependencies its owners have never actually met: hallucinated package names, code that runs at install time, and the same package sitting in the tree at four different versions. It is a supply-chain tool built with no supply chain. Final score: 4.76.
Third place went to Revenant from Strata, a SQLite engine written from scratch in Rust with no crates, no C library and no unsafe code. Its strongest check was interoperability: it writes databases that SQLite itself can then open and modify, which is far harder to fake than reading one. Final score: 4.67.
The Package Killer award went to zdh from The Goated Duo, an HTTP/2 server on the Go standard library that replaces golang.org/x/net/http2 and its HPACK package outright. It implements all ten frame types, hand-built Huffman tables, flow control and stream state, running over raw TCP with nothing from net/http underneath.
Behind the podium sat an Excellence tier that would have won most hackathons: a full-text search engine in pure Go with a write-ahead log that treats a torn tail as an expected crash shape, a recursive DNS resolver that walks the root servers itself, a git object and packfile decoder that matches git on a real 994-commit repository, a documentation site generator with a from-scratch WebSocket for live reload, and a passkey login stack that replaces the CBOR and COSE libraries every Go WebAuthn package depends on.
The Write-Ups
A Write-Up Side Quest asked participants to document what the constraint taught them, and the winners treated failure as the content. Sai Ram Dash replaced eleven everyday npm packages and ran 856,168 differential checks against the originals, and ended up testing the package being replaced when the semver library’s intersects() function gave opposite answers on swapped arguments. Pal Ghevariya built the JSONTestSuite harness before writing a JSON parser in Rust, watched 19 of 47 must-reject number fixtures slip through the standard float parser, and wrote a number state machine by hand in response.
What Separated the Field
The empty manifest turned out to be a test of honesty more than cleverness. The teams that scored highest did not hide the cost of going without packages. They disclosed where a language forced a shell-out, wrote a STDLIB.md that named every package they replaced and what they gave up doing it, and built checks that verify the manifest on every build instead of claiming it once. The panel checked those claims in return, down to counting every unwrap() call in one storage engine’s source.
Why the Format Matters
Most engineering organisations will never ship software with no dependencies, and the competition was not built to argue that they should. Its value is narrower and more practical. By taking packages away, Zero Dependency 2026 made visible what a team actually understands about the platform it builds on, and it rewarded the discipline that dependency-heavy work tends to skip: test the replacement against the original, write down what the tests cannot prove, and let someone else run them. Those are the same habits four senior reviewers from Zendrop, Fidelity National Financial, Amazon and Lennar enforce in their own systems every week.
Full results, judge comments and participant write-ups are published on the event recap at raptors.dev.
About Hackathon Raptors
Hackathon Raptors, a UK Community Interest Company (CIC #15557917), is London-based and runs technology challenges that test engineering fundamentals under real constraints. Its community brings together engineers from Apple, Amazon, Microsoft, IBM and other major technology organisations. More information at raptors.dev.
Feature image by Jakub Zerdzicki from Pexels
