// answer sheet
What your language does without a package, where it stops, and which import is worth replacing by hand.
// ask the machine first
Rules, tracks, scoring and every cheat-sheet on this page, as plain text. It answers from this event instead of guessing.
Fourteen lines of hand-written JavaScript, zero packages · raw text
// read this first
The gaps are the valuable half. Rust's std has no async runtime. Python's tomllib cannot write. SQLite is not in the .NET base class library. Read your language's "where the stdlib stops" before you commit to a track, not on day three.
Every substitution here is a STDLIB.md entry. That file feeds Zero-Dependency Craft, 30% of your score. Also: Go 1.27, Rust 1.98 and Bun 1.4 all shipped the week of 19 August, so check the versions above against whatever you remember.
// at a glance
One row per thing you would normally install. Read down your column.
| Need | Node 24/26 | Python 3.14 | Go 1.27 | Rust 1.98 | Java 25 | .NET 10 |
|---|---|---|---|---|---|---|
| CLI args | util.parseArgs | argparse | flag | std::env::args | String[] args | args |
| Tests | node:test | unittest | testing + synctest | #[test] | none in JDK | NuGet |
| HTTP server | node:http | http.server* | net/http | none | com.sun.net.httpserver | HttpListener |
| HTTP client | fetch | urllib.request | net/http | none | HttpClient | HttpClient |
| JSON | JSON | json | encoding/json v2 | none | none | System.Text.Json |
| CSV | by hand | csv | encoding/csv | by hand | by hand | by hand |
| TOML | Bun.TOML only | tomllib (read) | none | none | none | none |
| SQLite | node:sqlite (RC) | sqlite3 | none | none | none | NuGet |
| Crypto / hashing | node:crypto | hashlib / hmac | crypto/* | none | javax.crypto | System.Security.Cryptography |
| Compression | node:zlib +zstd | zlib / zstd | compress/* | none | java.util.zip | System.IO.Compression |
| Terminal colour | util.styleText | raw ANSI | raw ANSI | raw ANSI | raw ANSI | raw ANSI |
| Templating | template literals | t-strings | text/template | format! | by hand | interpolation |
| File watching | fs.watch | polling | polling | polling | WatchService | FileSystemWatcher |
| Async runtime | built in | asyncio | goroutines | none | virtual threads | Task |
| UUID | crypto.randomUUID | uuid v1-v8 | uuid (new in 1.27) | by hand | UUID | Guid |
* http.server is documented as not for production. none means the standard library has no answer and writing it is your project. Cells naming a package manager (NuGet) mean the capability exists but not with an empty manifest.
// eight runtimes
What shipped recently, what replaces the package, and where it stops.
The runtime that started this whole problem now has the deepest set of built-in replacements for it. Most of a Track A tool is already in the box.
node:sqlite is now a Release Candidate (Stability 1.2) as of v24.15.0 and v25.7.0. No flag, no warning. An embedded database with an empty manifest. util.parseArgs() handles string and boolean only. Node core has stated it is deliberately minimal and not meant to replace full parsers. Subcommands, counts and type coercion are yours to write. node:test has no snapshot testing or module mocking at parity with Jest. node:sea single-executable apps are still experimental. | You'd install | Use instead | Since |
|---|---|---|
| chalk 319.8M/wk | util.styleText() | v20.12, stable v22.17 |
| readable-stream 185.6M/wk | node:stream + stream/promises | stable |
| form-data 100.9M/wk | global FormData + fetch | v18 |
| minimist 80.5M/wk | util.parseArgs() | v18.3 |
| node-fetch / axios | global fetch (Undici) | stable v18 |
| mocha / jest / tap | node:test + node:assert | stable v20 |
| nodemon 7.8M/wk | node --watch | v18.11 |
| dotenv | process.loadEnvFile() / --env-file | v20.6 |
| strip-ansi | util.stripVTControlCharacters() | stable |
| uuid | crypto.randomUUID() | stable |
| glob | fs.glob() / fs.globSync() | v22 |
| ws | global WebSocket | v22 |
| better-sqlite3 | node:sqlite | RC v24.15 / v25.7 |
| pkg / nexe | node:sea | experimental |
Bun 1.4 shipped fifteen new built-ins whose stated purpose is deleting npm dependencies. If your project is a parser, an archiver or an image tool, this is the shortest path to an empty manifest.
Bun.TOML — TOML v1.1.0, 708/708 of toml-test, and it has a stringify(). The only runtime here with a TOML writer. Bun.JSON5, Bun.JSONC, Bun.JSONL — JSON5, JSON-with-comments, and newline-delimited JSON. Bun.XML — SIMD XML parser and serializer. Bun.Image — decode, resize, rotate and encode JPEG, PNG, WebP, GIF and BMP, with no native addon. Bun.Archive — create and extract tarballs off the main thread. Bun.stringWidth(), Bun.sliceAnsi(), Bun.wrapAnsi() — terminal-column-aware, ANSI and grapheme aware. URLPattern, CompressionStream / DecompressionStream (gzip, deflate, brotli, zstd), Bun.Terminal for PTYs, Bun.markdown, Bun.cron(). Bun.SQL — one API for MySQL, MariaDB, PostgreSQL and SQLite, plus bun:sqlite and Bun.redis. deno fmt, lint, test, bench, doc and compile inside the one binary. dependencies is {}" — but write the reasoning into your STDLIB.md rather than leaving a judge to work it out. | You'd install | Use instead | Since |
|---|---|---|
| @iarna/toml | Bun.TOML | Bun 1.4 |
| json5 | Bun.JSON5 | Bun 1.4 |
| jsonc-parser | Bun.JSONC | Bun 1.4 |
| ndjson | Bun.JSONL | Bun 1.4 |
| fast-xml-parser / xml2js | Bun.XML | Bun 1.4 |
| sharp | Bun.Image | Bun 1.3.14 |
| tar | Bun.Archive | Bun 1.4 |
| string-width / slice-ansi / wrap-ansi | Bun.stringWidth / sliceAnsi / wrapAnsi | Bun 1.4 |
| path-to-regexp | URLPattern | Bun 1.4 |
| better-sqlite3 | bun:sqlite | stable |
| prettier / eslint / jest | deno fmt / lint / test | Deno 1.x |
The batteries-included language, still. The traps are narrow and specific: read-only TOML, an HTTP client nobody loves, and a server the docs tell you not to deploy.
compression.zstd (PEP 784) — Zstandard in the standard library, also wired into tarfile, zipfile and shutil. concurrent.interpreters (PEP 734) — isolated subinterpreters with a per-interpreter GIL. uuid gains versions 6, 7 and 8; versions 3–5 generate up to 40% faster. argparse, json, unittest and calendar CLIs, and syntax highlighting in the REPL. pdb -p PID attaches to a live process with zero overhead. tomllib is read-only by design. There is no TOML writer in the standard library and core has repeatedly declined to add one. If you need to write TOML, writing it is your project. urllib.request is HTTP/1.1 only, with no connection pooling and no HTTP/2. It is the only stdlib HTTP client you get. http.server is documented as not for production. Fine for a demo; say so in your README rather than letting a judge find out. | You'd install | Use instead | Since |
|---|---|---|
| requests / httpx | urllib.request | always |
| click / typer | argparse (with colour) | colour in 3.14 |
| pytest | unittest | always |
| toml / tomli | tomllib (read only) | 3.11 |
| zstandard | compression.zstd | 3.14 |
| python-dotenv | os.environ + a 10-line parser | always |
| colorama | raw ANSI escapes | always |
| jinja2 (simple cases) | string.Template or t-strings | t-strings in 3.14 |
| sqlalchemy | sqlite3 | always |
| passlib (hashing) | hashlib.scrypt / pbkdf2_hmac | 3.6 |
| pyotp | hmac + struct + base64 (~15 lines) | always |
The strongest zero-dependency language in the field, and 1.27 widened the lead. If you want the constraint to feel like a normal Tuesday, pick Go.
uuid is now in the standard library — RFC 9562, uuid.NewV4(), uuid.NewV7(), and random-component UUIDs compare with ==. encoding/json/v2 and encoding/json/jsontext graduated out of GOEXPERIMENT. Classic encoding/json is now implemented on top of v2 with behaviour preserved. net/http/httptest.NewTestServer — an in-memory fake network, built to pair with testing/synctest. crypto/mldsa — post-quantum ML-DSA (FIPS 204), wired into crypto/x509 and crypto/tls. goroutineleak profile in runtime/pprof is generally available, with a net/http/pprof endpoint. testing/synctest is stable (virtualised clock bubbles for deterministic concurrency tests — use synctest.Test, Run is deprecated), plus sync.WaitGroup.Go, os.Root, and net/http CrossOriginProtection for stdlib anti-CSRF. database/sql is the interface, not an implementation — Track D in Go means writing the storage engine, which is the point of the track anyway. html/template is escaping-first, not a general-purpose templating language. | You'd install | Use instead | Since |
|---|---|---|
| google/uuid | uuid | 1.27 |
| json-iterator | encoding/json/v2 | 1.27 |
| gorilla/mux, chi | net/http ServeMux patterns | 1.22 |
| logrus, zap | log/slog | 1.21 |
| testify | testing + testing/synctest | 1.25 |
| gorilla/csrf | net/http CrossOriginProtection | 1.25 |
| cobra (simple cases) | flag | always |
| gocsv | encoding/csv | always |
The hardest language in this event, by a distance. That is the point: a working stdlib-only Rust submission reads as more impressive, not less. Budget for it and be honest about what you cut.
format_into plus core::fmt::NumBuffer — buffered integer formatting that benchmarks on par with the itoa crate. A standard-library replacement for a crate people actually install, which makes it free Package Killer material. algebraic_add, _sub, _mul, _div, _rem on f32 and f64. str::substr_range, <[T]>::subslice_range, strip_circumfix, String::from_utf16le/be, NonZero::from_str_radix, Atomic::from_mut. File::lock / try_lock / unlock (1.89), LazyCell and LazyLock (1.80), <[T]>::as_chunks (1.88). std has the Future trait and no executor. Threads plus std::sync::mpsc are your zero-dependency concurrency answer. rand. No regex. No date formatting beyond SystemTime and Instant. std::net::TcpListener plus a hand-rolled HTTP/1.1 parser is the realistic Track C path. Plan for it on day one, not day three. | You'd install | Use instead | Since |
|---|---|---|
| itoa | format_into + NumBuffer | 1.98 |
| once_cell | LazyLock / LazyCell | 1.80 |
| fs2 | File::lock / try_lock / unlock | 1.89 |
| crossbeam-channel (basic) | std::sync::mpsc | always |
| tokio (basic) | std::thread + std::sync | always |
| clap | std::env::args + match | always |
Java 25 quietly became the best single-file language here. No build tool, no manifest, no ceremony — which lines up exactly with the Single File bonus.
void main() { IO.println("hi"); } in a bare .java file, with everything java.base exports auto-imported, run as java Hello.java. No build tool, no manifest, one file. import module java.base;. ThreadLocal. javax.crypto. HttpClient via JEP 517. java Test.java with assertions and a main is your test harness. com.sun.net.httpserver exists and works, but it is demo-grade. Say so in your README. | You'd install | Use instead | Since |
|---|---|---|
| OkHttp / Apache HttpClient | java.net.http.HttpClient | 11 |
| commons-codec (hex) | java.util.HexFormat | 17 |
| thread pools | virtual threads | 21 |
| ThreadLocal | scoped values | 25 |
| picocli (simple cases) | String[] args | always |
| commons-compress (zip/gzip) | java.util.zip | always |
File-based apps make C# a scripting language for the first time. The one real weakness is storage: SQLite is not in the box.
dotnet run app.cs, or just dotnet app.cs, with no .csproj. A #!/usr/bin/env dotnet shebang makes it a cross-platform shell script, and dotnet project convert graduates it when it outgrows one file. [JsonSerializable]) rather than reflection-based serialization. .slnx replaces the 2002-era .sln format; migrate with dotnet solution migrate. WebSocketStream for simpler WebSocket code, and TLS 1.3 for macOS clients. System.Text.Json gains strict mode and duplicate-property rejection; CompareOptions.NumericOrdering; ISOWeek for DateOnly. Microsoft.Data.Sqlite is a NuGet package, so Track D in C# means writing a storage engine rather than wrapping one. This is the single place .NET is weaker than Node, Python and Bun. main with assertions. HttpListener is the built-in server. It works; it is not Kestrel. | You'd install | Use instead | Since |
|---|---|---|
| Newtonsoft.Json | System.Text.Json | Core 3.0 |
| CommandLineParser | args + switch | always |
| RestSharp | HttpClient | always |
| BouncyCastle (common cases) | System.Security.Cryptography | always |
| SharpZipLib | System.IO.Compression | always |
| Serilog (console only) | ILogger / Console | always |
The honest track. libc and POSIX give you sockets, files, threads and printf. Everything above that is yours to write, which is why "every line is mine" is literally true here.
pthreads for concurrency, <stdio.h> and <string.h> for the rest. // A through F
What carries each track, and the one thing that sinks a submission.
util.parseArgs, argparse, flag, or a match over std::env::args. fs.glob (Node 22+), pathlib / os.walk, filepath.WalkDir, std::fs::read_dir. util.styleText in Node, raw ANSI escapes everywhere else. Honour NO_COLOR and check whether stdout is a TTY. Shelling out to a tool you installed separately. That is a dependency you are hiding, and it is called out under Out of Scope.
Easiest in: Node or Go
node:test, unittest and testing all do subtests cleanly. toml-test suite. If you write JSON, target JSONTestSuite. Judges can run those. A parser that only handles the happy path. Escaping, nesting and malformed input are the whole grade here.
Easiest in: Any — this is the most language-agnostic track
net/http ServeMux gained method and wildcard patterns in 1.22, so you do not need a router. CrossOriginProtection to net/http — stdlib anti-CSRF, no middleware package. httptest.NewTestServer gives you an in-memory network that pairs with testing/synctest for deterministic timeout tests. Rust and C have no HTTP in the standard library at all. If you pick them here you are writing an HTTP/1.1 parser, and that needs to be day-one scope, not a day-three surprise.
Easiest in: Go
fsync after append, or say plainly in the README that you did not. node:crypto, hashlib, hash/fnv, std::hash. Wrapping node:sqlite or sqlite3 and calling it a storage engine. It is legal, but Zero-Dependency Craft rewards the layer you wrote, not the one you called.
Easiest in: Go or Rust — and this is Rust's best track
node:crypto, hashlib / hmac / secrets, crypto/*, javax.crypto, System.Security.Cryptography. hmac + struct + base32. It is the cleanest zero-dep security project in the field. scrypt and pbkdf2_hmac are in every stdlib here. Argon2 is not — say which you used and why. Rolling your own cipher. It is an explicit rule, and it turns a strong submission into a disqualifying one. Rust is the trap: std has no crypto at all.
Easiest in: Python or Go
Bun.Image, Bun.Archive, Bun.XML) open projects that were previously impossible with an empty manifest. A stunt. "Reads as idiomatic and intentional, not a stunt" is in the track's own criteria — a clever thing nobody would use scores below a plain thing people would.
Easiest in: Whatever you already know best
// +3 bonus
Pick one, replace it cleanly, document it in STDLIB.md.
The +3 Package Killer bonus wants a package people actually install, cleanly reimplemented and documented in STDLIB.md. These are already-verified targets. Bonus weight goes to the ones with real download numbers behind them.
| Target | Replacement | Why it's worth points |
|---|---|---|
| chalk 319.8M weekly | util.styleText() Node | Already in the box — kill it by writing the colour layer yourself and beating the API. |
| readable-stream 185.6M weekly | node:stream Node | A back-pressure-correct stream implementation is a real Track B project. |
| minimist 80.5M weekly | util.parseArgs() Node | parseArgs handles strings and booleans only. Subcommands and coercion are open ground. |
| nodemon 7.8M weekly | node --watch Node | A debounced, ignore-aware watcher on fs.watch is a tidy Track A tool. |
| itoa crates.io staple | format_into + NumBuffer Rust | New in Rust 1.98 and benchmarked on par with the crate. The cleanest kill on this list. |
| once_cell crates.io staple | LazyLock / LazyCell Rust | Stable since 1.80 and still installed out of habit. |
| google/uuid Go staple | uuid Go | Moved into the standard library in Go 1.27, nine days before kickoff. |
| @iarna/toml — | Bun.TOML Bun | Or write a TOML writer for Python, where the stdlib deliberately has none. |
| left-pad the original sin | String.padStart() any | Only as a footnote inside something larger. On its own it is explicitly Out of Scope. |
// settled in advance
Bun and Deno built-ins count. Bun.Image, Bun.TOML and bun:sqlite are runtime APIs, not a classical standard library. The rule reads "Node (or Deno/Bun) built-ins only, dependencies is {}", so they are inside the line. Note the reasoning in your STDLIB.md.
node:sqlite is a Release Candidate, not an experiment. Stability 1.2 since v24.15.0 and v25.7.0: no flag, no warning, no rule broken. Pin your Node version in the README.
Anything else, ask in the Discord before the freeze. A ruling beats an appeal.
// 72 hours. one rule.
The standard library and whatever you can do with it.