# ZERO DEPENDENCY HACKATHON — FULL CONTEXT PACK

You are helping someone competing in the Zero Dependency hackathon. Everything below is
the authoritative event brief plus the official standard-library cheat-sheets.

Ground every answer in this document. The single hard rule is that the shipped artifact
ships an EMPTY dependency manifest — standard library only. If you are about to suggest
installing a package, stop and find the standard-library answer instead. If this document
says a language has no standard-library answer for something, say so plainly rather than
inventing one; the honest gap is worth more to this entrant than a confident guess.

Source: https://zerodepshack.com/cheatsheets
Cheat-sheet data verified: 27 August 2026

# THE EVENT

Standard library only. No packages. No supply chain. Just skill.
August 28-31, 2026 · Online · Free · 6 tracks
Register: https://tally.so/r/2EY7zD
Discord: https://discord.com/invite/xfYPDZYqeh

Half your code is written by an AI that hallucinates the other half's package names. The registry it pulls from added 454,600 malicious packages last year alone. This hackathon is the counter-move: build something real using nothing but the language you already have.

# THE ONE RULE — WHAT COUNTS AS ZERO DEPENDENCY

Zero third-party RUNTIME dependencies. The shipped artifact's dependency manifest is empty.

- JavaScript / TypeScript: Node (or Deno/Bun) built-ins only. package.json dependencies is {}. No npm installs.
- Python: The standard library only. No pip install. requirements.txt empty or absent.
- Go: stdlib only. go.mod has no require block (the toolchain and golang.org/x are not a free pass, stdlib means stdlib).
- Rust: std only. Cargo.toml [dependencies] empty. No crates, including no serde.
- C / C++: libc, POSIX and the C++ standard library (libstdc++/libc++). No vendored third-party libraries, and no Boost, fmt, abseil or header-only drop-ins.
- Java / Kotlin / C#: The platform standard library (JDK / BCL) only. No Maven/NuGet runtime deps.

Allowed and not counted against you: your language's own compiler, build tool and formatter;
a standard-library test tool where one exists.

The one grey area, ruled: if your language ships no test framework at all, a dev-only test
dependency is permitted, but it must never appear in the runtime artifact and must be disclosed
in STDLIB.md. Test tooling is the only exception.

The loophole, closed: copying a library's source into src/ to fake an empty manifest is a
dependency with extra steps. Any code you did not write this weekend must be disclosed in
STDLIB.md or it scores against you.

Two further rulings published on the cheat-sheet page:
1. Bun and Deno built-ins count. Bun.Image, Bun.TOML and bun:sqlite are runtime APIs rather than
   a classical standard library, but the rule as written is "Node (or Deno/Bun) built-ins only,
   dependencies is {}", so they are inside the line. Put the reasoning in STDLIB.md.
2. node:sqlite is a Release Candidate (Stability 1.2) as of Node v24.15.0 and v25.7.0, not an
   experiment. No flag, no warning. Using it breaks no rule. Pin your Node version in the README.

# TRACKS

## Track A — Developer Tools & CLI

The daily-driver track. A linter, formatter, task runner, git helper, or file utility, the kind of tool most people reach for a dozen packages to build. Do it with the standard library.

Build something that:
- Solves a real workflow annoyance you actually have
- Ships as a single runnable artifact with a clean CLI surface (flags, exit codes, sane stdout/stderr)
- Uses only stdlib for argument parsing, file walking, and output, no helper packages
- Reads as idiomatic to a senior reviewer in your language
Audience: Tooling authors, DX engineers, CLI builders

## Track B — Parsers & Data Formats

The from-scratch track. A JSON, CSV, Markdown, or config parser. A template engine. A regex engine. A serializer. The things everyone imports and almost nobody has written.

Build something that:
- Correctly handles the ugly edge cases, not just the happy path (escaping, nesting, malformed input)
- Reports useful errors with position information
- Has a test suite that proves the edge cases pass
- Implements the format by hand, with no parsing or serialization package
Audience: Language nerds, Compiler folks, Craftspeople

## Track C — Web & Network

The stdlib-net track. An HTTP server or router, a static-site server, an HTTP client, a DNS tool, a chat over raw TCP. Built on your language's networking primitives and nothing above them.

Build something that:
- Handles concurrent connections without a framework
- Speaks the protocol correctly enough to interoperate with real clients or servers
- Uses only the stdlib networking layer (net / http / sockets), no framework or client library
- Documents its concurrency model honestly
Audience: Backend engineers, SREs, Protocol enthusiasts

## Track D — Data & Storage

The storage-engine track. A key-value store, an embedded database, a cache, a log-structured store, a search index. The layer most apps rent from a library and never look inside.

Build something that:
- Persists and retrieves correctly across process restarts
- Documents its durability and consistency guarantees, and where it cuts corners
- Uses only stdlib file, buffer, and hashing primitives, no storage or serialization dependency
- Survives a basic crash or concurrent-access test
Audience: Backend engineers, Database curious, Systems folks

## Track E — Security & Crypto Utilities

The trust-nothing track. A password manager, a TOTP/2FA generator, a file encryptor, a hasher, a secrets scanner. Security tools, ironically, are where a stray dependency hurts most, so build one with none.

Build something that:
- Uses only the standard library's crypto primitives, never a third-party crypto package
- Never rolls its own cipher: compose stdlib primitives correctly, don't invent them
- Handles keys, salts, and secrets with documented, defensible choices
- Fails safe, with honest notes on its threat model in the README
Audience: Security engineers, Backend engineers, Privacy builders

## Track F — Open / Wildcard

Surprise us. A game, a visualizer, an interpreter, a compression tool, a scheduler, anything genuinely useful that a reasonable engineer would assume needs packages. Pick it, build it stdlib-only, and justify the build in your README.

Build something that:
- Solves a real problem people would actually use
- Would normally be assumed to require third-party dependencies
- Ships with an empty manifest and a README explaining how you avoided the usual imports
- Reads as idiomatic and intentional, not a stunt
Audience: Polyglots, Generalists, Anyone with something to prove

# DELIVERABLES

You submit:

- Public GitHub repo with the tool
- Build command that produces a runnable artifact in one step
- Empty dependency manifest for your language
- Dependency proof (command output or CI log showing zero third-party deps)
- README.md: what it does, how to run it, its limits
- STDLIB.md: every stdlib-for-package substitution you made
- 5-minute demo video showing the tool working and the manifest being empty

Repository layout (advisory — judges read what you actually ship). Root: your-tool/
  README.md — what it does, how to run, honest limits
  STDLIB.md — every "I'd normally import X, instead I used stdlib Y"
  Makefile / build — one command to a runnable artifact
  src/ — your code, all of it written this weekend
  tests/ — proves the edge cases pass
  package.json — dependencies: {} (or go.mod / Cargo.toml / requirements.txt, empty)
  deps-proof.txt — output showing zero third-party deps
  .zero-dep.toml — track letter, one-line pitch

- One command builds. make, cargo build, go build, docker compose up. If a judge has to read your CI to figure out how to run it, you've failed this rule.
- The manifest is the rulebook. Empty is empty. A judge should confirm zero deps in five seconds, not five minutes.
- STDLIB.md counts. It feeds directly into Zero-Dependency Craft (30%). Empty bullets don't count; real substitutions do.
- Numbers are honest. If your parser is slower than the one you'd normally import, say so. A naive but honest implementation scores above a fast one that hides its corners.

# SCORING

- Functionality & Usefulness (35%): Does it build with one command, run, and do something a real person would want? A useful tool with a rough edge beats a polished thing that does nothing. This is the largest weight for a reason: the constraint is the point, but the software still has to matter.
- Zero-Dependency Craft (30%): How well did you replace what you'd normally import? Empty manifest verified at submission. STDLIB.md quality lives here: the depth and honesty of your stdlib-for-package substitutions. Vendoring source to fake an empty manifest is penalised here.
- Code Quality & Idiom (25%): Does the code read as idiomatic to a senior reviewer in your language, or as a fight against the standard library? Elegance of the hand-rolled implementation, clarity of error handling, sensible structure.
- Innovation (10%): Creative wildcard picks. A genuinely surprising thing built with nothing but stdlib. The submission that makes a judge say "I didn't know you could do that without a package."

Bonus challenges (optional — pick one and nail it):
- Single File (+5, Hard): Ship the entire project as one source file that is still genuinely useful. No src/ tree, no modules, one file a person could read top to bottom and understand.
- Reproducible Build (+5, Hard): Build your artifact twice and produce byte-identical output. Publish both hashes. Determinism is the discipline that most dependency-heavy stacks quietly lost.
- Package Killer (+3, Medium): Cleanly reimplement a specific package that people actually install (left-pad, is-even, a chalk-style colorizer, a requests-style client) and document the replacement in STDLIB.md. Bonus weight for killing something with millions of weekly downloads.
- STDLIB Log (+3, Medium): Submit a STDLIB.md with at least 10 real, non-trivial stdlib-for-package substitutions, each with a one-line rationale. Judges will read it. Empty bullet points won't count.

# PRIZES

- 1st Place — $800 — Grand Prize: The tool that was genuinely useful, provably zero-dep, and read as if the standard library were plenty all along. The one a judge wanted to install.
- 2nd Place — $400 — Runner-Up: Exceptional execution across the board. Real utility, clean stdlib craft, an honest STDLIB.md. Almost took the crown.
- 3rd Place — $200 — Third Place: A standout, either for the surprising thing it built or the popular package it made look unnecessary.
- Package Killer — $100 — Best Reimplementation: For the team whose stdlib reimplementation most convincingly replaced a package people actually install, documented in STDLIB.md, ideally something with real download numbers behind it.
- Side Quest · The Write-Up — $300 — $100 x 3: Retiring the community vote and putting the same $300 here. A popularity contest rewards the biggest audience; we would rather reward the best explanation. Publish a post about your build: what you reimplemented, what the stdlib made painful, the package you made look unnecessary, the edge case that ate an afternoon. Tag Hackathon Raptors. Top 3, judged on insight, not follower count.

# OUT OF SCOPE — THESE WILL NOT SCORE WELL

- Hello-world or single-function toys ("I reimplemented left-pad and nothing else")
- An empty manifest that shells out to a tool you installed separately, that's a dependency you're hiding
- Vendoring a library's source into src/ to fake zero-dep, without disclosing it in STDLIB.md
- Rolling your own cipher in Track E, compose stdlib crypto correctly, don't invent it
- LLM dumps with no README, no STDLIB.md, and no human able to explain the design
- Anything requiring custom hardware, embedded targets, audio/DSP rigs, GUI frameworks, or proprietary toolchains, keep it laptop-friendly
- Projects that need a running third-party service (a database server, a cloud API) to do anything

# RULES

- Zero Third-Party Runtime Dependencies: The core rule. Your shipped artifact's dependency manifest is empty. Standard library only. See What counts as zero dependency for the per-language definition.
- What Counts as Standard Library: Defined per language under What counts as zero dependency. Your compiler, build tool, and a stdlib test tool are fine. If your language ships no test framework, a dev-only test dependency is allowed but must be disclosed in STDLIB.md and never ship in the artifact.
- Standalone & Runnable: Your tool must build with a single command and produce a runnable artifact. No "works on my machine" submissions.
- New Code Only: All code written during the 72-hour window. AI assistance and standard-library use are fully expected. A pre-existing project of yours is not eligible.
- No Vendoring to Fake It: Copying a third-party library's source into your repo to keep the manifest empty is still a dependency. If you include any code you didn't write this weekend, disclose it in STDLIB.md, or it scores against you.
- Team Size: 1-4 people. Solo entries welcome. Find teammates on the Hackathon Raptors Discord before or during the event.
- Pick a Track: Choose one track A-F. Your submission must clearly target it. Track F (Open) requires a defensible rationale in your README.
- Source Code Public: GitHub repo, OSI-approved license, public at submission. Anonymous-username submissions accepted, but the team must be reachable for written follow-up by judges during the evaluation window.
- AI Tools Are Expected: Claude Code, Cursor, Aider, Copilot, local models, bring whatever you've got. We don't gatekeep on whether you used AI; we gatekeep on whether the result holds up. The README, STDLIB.md, and empty manifest are the receipts. If the artifact can't be defended in writing, it scores accordingly.

# TIMELINE (all times UTC)

Pre-Event:
- July 31, 2026 — Registration opens: Join the Discord, start thinking about what you'd build.
- August 24, 2026 — Team formation: 1-4 people per team. Solo welcome.
- August 26, 2026 — Cheat-sheets posted: Standard-library cheat-sheets and per-track guidance posted.

Hackathon · 72h:
- August 28, 2026 · 18:00 UTC — Kickoff: Hacking begins.
- August 31, 2026 · 18:00 UTC — Code freeze: Submissions due. Empty manifests verified.

Post-Event:
- Aug 31 to Sep 10, 2026 — Judging window: Each project reviewed independently by multiple judges on structured forms across the one-week window. Weighted scores and written feedback to every team.
- September 8, 2026 — Write-Up side quest closes: Deadline for the $300 Write-Up submissions. Top 3, $100 each.
- September 11, 2026 — Winners announced: Main results and Write-Up top 3.

# CAPABILITY MATRIX — WHAT SHIPS IN THE BOX

Languages: Node 24/26 | Python 3.14 | Go 1.27 | Rust 1.98 | Java 25 | .NET 10

- CLI args: Node 24/26 = util.parseArgs; Python 3.14 = argparse; Go 1.27 = flag; Rust 1.98 = std::env::args; Java 25 = String[] args; .NET 10 = args
- Tests: Node 24/26 = node:test; Python 3.14 = unittest; Go 1.27 = testing + synctest; Rust 1.98 = #[test]; Java 25 = none in JDK; .NET 10 = NuGet
- HTTP server: Node 24/26 = node:http; Python 3.14 = http.server*; Go 1.27 = net/http; Rust 1.98 = none; Java 25 = com.sun.net.httpserver; .NET 10 = HttpListener
- HTTP client: Node 24/26 = fetch; Python 3.14 = urllib.request; Go 1.27 = net/http; Rust 1.98 = none; Java 25 = HttpClient; .NET 10 = HttpClient
- JSON: Node 24/26 = JSON; Python 3.14 = json; Go 1.27 = encoding/json v2; Rust 1.98 = none; Java 25 = none; .NET 10 = System.Text.Json
- CSV: Node 24/26 = by hand; Python 3.14 = csv; Go 1.27 = encoding/csv; Rust 1.98 = by hand; Java 25 = by hand; .NET 10 = by hand
- TOML: Node 24/26 = Bun.TOML only; Python 3.14 = tomllib (read); Go 1.27 = none; Rust 1.98 = none; Java 25 = none; .NET 10 = none
- SQLite: Node 24/26 = node:sqlite (RC); Python 3.14 = sqlite3; Go 1.27 = none; Rust 1.98 = none; Java 25 = none; .NET 10 = NuGet
- Crypto / hashing: Node 24/26 = node:crypto; Python 3.14 = hashlib / hmac; Go 1.27 = crypto/*; Rust 1.98 = none; Java 25 = javax.crypto; .NET 10 = System.Security.Cryptography
- Compression: Node 24/26 = node:zlib +zstd; Python 3.14 = zlib / zstd; Go 1.27 = compress/*; Rust 1.98 = none; Java 25 = java.util.zip; .NET 10 = System.IO.Compression
- Terminal colour: Node 24/26 = util.styleText; Python 3.14 = raw ANSI; Go 1.27 = raw ANSI; Rust 1.98 = raw ANSI; Java 25 = raw ANSI; .NET 10 = raw ANSI
- Templating: Node 24/26 = template literals; Python 3.14 = t-strings; Go 1.27 = text/template; Rust 1.98 = format!; Java 25 = by hand; .NET 10 = interpolation
- File watching: Node 24/26 = fs.watch; Python 3.14 = polling; Go 1.27 = polling; Rust 1.98 = polling; Java 25 = WatchService; .NET 10 = FileSystemWatcher
- Async runtime: Node 24/26 = built in; Python 3.14 = asyncio; Go 1.27 = goroutines; Rust 1.98 = none; Java 25 = virtual threads; .NET 10 = Task
- UUID: Node 24/26 = crypto.randomUUID; Python 3.14 = uuid v1-v8; Go 1.27 = uuid (new in 1.27); Rust 1.98 = by hand; Java 25 = UUID; .NET 10 = Guid

* http.server is documented as not for production. none means the standard library has no answer and writing it is your project. Cells naming a package manager (NuGet) mean the capability exists but not with an empty manifest.
"none" means the standard library has no answer and writing it is the project.

# STANDARD-LIBRARY CHEAT-SHEETS

## JavaScript / TypeScript — 24.19 LTS · 26.x Current (24 LTS: 6 May 2025 · 26: 5 May 2026)

The runtime that started this whole problem now has the deepest set of built-in replacements for it. Most of a Track A tool is already in the box.

New since you last looked:
- node:sqlite is now a Release Candidate (Stability 1.2) as of v24.15.0 and v25.7.0. No flag, no warning. An embedded database with an empty manifest.
- Node 26 (5 May 2026) enables the Temporal date/time API by default, on V8 14.6 and Undici 8.0.
- Node 20 reached end of life on 30 April 2026. Do not target it.
- From October 2026 Node ships one major a year, every release becomes LTS, and the odd/even distinction disappears. Node 26 is the last release under the old model.

Instead of installing it:
- chalk (319.8M/wk) -> util.styleText() [since v20.12, stable v22.17]
- readable-stream (185.6M/wk) -> node:stream + stream/promises [since stable]
- form-data (100.9M/wk) -> global FormData + fetch [since v18]
- minimist (80.5M/wk) -> util.parseArgs() [since v18.3]
- node-fetch / axios -> global fetch (Undici) [since stable v18]
- mocha / jest / tap -> node:test + node:assert [since stable v20]
- nodemon (7.8M/wk) -> node --watch [since v18.11]
- dotenv -> process.loadEnvFile() / --env-file [since v20.6]
- strip-ansi -> util.stripVTControlCharacters() [since stable]
- uuid -> crypto.randomUUID() [since stable]
- glob -> fs.glob() / fs.globSync() [since v22]
- ws -> global WebSocket [since v22]
- better-sqlite3 -> node:sqlite [since RC v24.15 / v25.7]
- pkg / nexe -> node:sea [since experimental]

Where the stdlib stops:
- util.parseArgs() handles string and boolean only. Node core has stated it is deliberately minimal and not meant to replace full parsers. Subcommands, counts and type coercion are yours to write.
- node:test has no snapshot testing or module mocking at parity with Jest.
- No TOML, no YAML, no templating engine in the box.
- node:sea single-executable apps are still experimental.

## Bun & Deno — Bun 1.4 (20 August 2026 — eight days before kickoff)

Bun 1.4 shipped fifteen new built-ins whose stated purpose is deleting npm dependencies. If your project is a parser, an archiver or an image tool, this is the shortest path to an empty manifest.

New since you last looked:
- Bun.TOML — TOML v1.1.0, 708/708 of toml-test, and it has a stringify(). The only runtime here with a TOML writer.
- Bun.JSON5, Bun.JSONC, Bun.JSONL — JSON5, JSON-with-comments, and newline-delimited JSON.
- Bun.XML — SIMD XML parser and serializer.
- Bun.Image — decode, resize, rotate and encode JPEG, PNG, WebP, GIF and BMP, with no native addon.
- Bun.Archive — create and extract tarballs off the main thread.
- Bun.stringWidth(), Bun.sliceAnsi(), Bun.wrapAnsi() — terminal-column-aware, ANSI and grapheme aware.
- URLPattern, CompressionStream / DecompressionStream (gzip, deflate, brotli, zstd), Bun.Terminal for PTYs, Bun.markdown, Bun.cron().
- Bun.SQL — one API for MySQL, MariaDB, PostgreSQL and SQLite, plus bun:sqlite and Bun.redis.
- Deno keeps deno fmt, lint, test, bench, doc and compile inside the one binary.

Instead of installing it:
- @iarna/toml -> Bun.TOML [since Bun 1.4]
- json5 -> Bun.JSON5 [since Bun 1.4]
- jsonc-parser -> Bun.JSONC [since Bun 1.4]
- ndjson -> Bun.JSONL [since Bun 1.4]
- fast-xml-parser / xml2js -> Bun.XML [since Bun 1.4]
- sharp -> Bun.Image [since Bun 1.3.14]
- tar -> Bun.Archive [since Bun 1.4]
- string-width / slice-ansi / wrap-ansi -> Bun.stringWidth / sliceAnsi / wrapAnsi [since Bun 1.4]
- path-to-regexp -> URLPattern [since Bun 1.4]
- better-sqlite3 -> bun:sqlite [since stable]
- prettier / eslint / jest -> deno fmt / lint / test [since Deno 1.x]

Where the stdlib stops:
- Bun's built-ins are runtime APIs, not a classical standard library. They are legal here — the rule is "Node (or Deno/Bun) built-ins only, dependencies is {}" — but write the reasoning into your STDLIB.md rather than leaving a judge to work it out.
- Bun 1.4 is eight days old at kickoff, is the first Bun written in Rust, and closed 2,900+ issues in one release. If it misbehaves, 1.3.14 is the safe fallback. Nothing in the scoring rewards being on the newest build.
- Deno's built-in lint and formatter have fewer rules and less configuration than ESLint and Prettier.

## Python — 3.14.7 (3.14.0: 7 October 2025 · 3.14.7: 5 August 2026)

The batteries-included language, still. The traps are narrow and specific: read-only TOML, an HTTP client nobody loves, and a server the docs tell you not to deploy.

New since you last looked:
- compression.zstd (PEP 784) — Zstandard in the standard library, also wired into tarfile, zipfile and shutil.
- t-strings (PEP 750) — template literals for safe custom interpolation. This is the stdlib answer when you were about to reach for a template engine.
- concurrent.interpreters (PEP 734) — isolated subinterpreters with a per-interpreter GIL.
- Free-threaded Python is now officially supported (PEP 779), not experimental.
- uuid gains versions 6, 7 and 8; versions 3–5 generate up to 40% faster.
- Colour output in the argparse, json, unittest and calendar CLIs, and syntax highlighting in the REPL.
- PEP 768 debugger interface — pdb -p PID attaches to a live process with zero overhead.

Instead of installing it:
- requests / httpx -> urllib.request [since always]
- click / typer -> argparse (with colour) [since colour in 3.14]
- pytest -> unittest [since always]
- toml / tomli -> tomllib (read only) [since 3.11]
- zstandard -> compression.zstd [since 3.14]
- python-dotenv -> os.environ + a 10-line parser [since always]
- colorama -> raw ANSI escapes [since always]
- jinja2 (simple cases) -> string.Template or t-strings [since t-strings in 3.14]
- sqlalchemy -> sqlite3 [since always]
- passlib (hashing) -> hashlib.scrypt / pbkdf2_hmac [since 3.6]
- pyotp -> hmac + struct + base64 (~15 lines) [since always]

Where the stdlib stops:
- tomllib is read-only by design. There is no TOML writer in the standard library and core has repeatedly declined to add one. If you need to write TOML, writing it is your project.
- urllib.request is HTTP/1.1 only, with no connection pooling and no HTTP/2. It is the only stdlib HTTP client you get.
- http.server is documented as not for production. Fine for a demo; say so in your README rather than letting a judge find out.
- No async HTTP client, no schema validation, no YAML.

## Go — 1.27 (19 August 2026 — nine days before kickoff)

The strongest zero-dependency language in the field, and 1.27 widened the lead. If you want the constraint to feel like a normal Tuesday, pick Go.

New since you last looked:
- uuid is now in the standard library — RFC 9562, uuid.NewV4(), uuid.NewV7(), and random-component UUIDs compare with ==.
- encoding/json/v2 and encoding/json/jsontext graduated out of GOEXPERIMENT. Classic encoding/json is now implemented on top of v2 with behaviour preserved.
- net/http/httptest.NewTestServer — an in-memory fake network, built to pair with testing/synctest.
- crypto/mldsa — post-quantum ML-DSA (FIPS 204), wired into crypto/x509 and crypto/tls.
- The goroutineleak profile in runtime/pprof is generally available, with a net/http/pprof endpoint.
- Still under-known from 1.25: testing/synctest is stable (virtualised clock bubbles for deterministic concurrency tests — use synctest.Test, Run is deprecated), plus sync.WaitGroup.Go, os.Root, and net/http CrossOriginProtection for stdlib anti-CSRF.

Instead of installing it:
- google/uuid -> uuid [since 1.27]
- json-iterator -> encoding/json/v2 [since 1.27]
- gorilla/mux, chi -> net/http ServeMux patterns [since 1.22]
- logrus, zap -> log/slog [since 1.21]
- testify -> testing + testing/synctest [since 1.25]
- gorilla/csrf -> net/http CrossOriginProtection [since 1.25]
- cobra (simple cases) -> flag [since always]
- gocsv -> encoding/csv [since always]

Where the stdlib stops:
- No YAML and no TOML in the standard library.
- No SQLite driver. database/sql is the interface, not an implementation — Track D in Go means writing the storage engine, which is the point of the track anyway.
- html/template is escaping-first, not a general-purpose templating language.

## Rust — 1.98.0 (20 August 2026 — eight days before kickoff)

The hardest language in this event, by a distance. That is the point: a working stdlib-only Rust submission reads as more impressive, not less. Budget for it and be honest about what you cut.

New since you last looked:
- format_into plus core::fmt::NumBuffer — buffered integer formatting that benchmarks on par with the itoa crate. A standard-library replacement for a crate people actually install, which makes it free Package Killer material.
- Algebraic float operations — algebraic_add, _sub, _mul, _div, _rem on f32 and f64.
- str::substr_range, <[T]>::subslice_range, strip_circumfix, String::from_utf16le/be, NonZero::from_str_radix, Atomic::from_mut.
- Slightly older and still under-used: File::lock / try_lock / unlock (1.89), LazyCell and LazyLock (1.80), <[T]>::as_chunks (1.88).

Instead of installing it:
- itoa -> format_into + NumBuffer [since 1.98]
- once_cell -> LazyLock / LazyCell [since 1.80]
- fs2 -> File::lock / try_lock / unlock [since 1.89]
- crossbeam-channel (basic) -> std::sync::mpsc [since always]
- tokio (basic) -> std::thread + std::sync [since always]
- clap -> std::env::args + match [since always]

Where the stdlib stops:
- No async runtime. std has the Future trait and no executor. Threads plus std::sync::mpsc are your zero-dependency concurrency answer.
- No serde. No JSON. No HTTP client or server. No TLS.
- No rand. No regex. No date formatting beyond SystemTime and Instant.
- std::net::TcpListener plus a hand-rolled HTTP/1.1 parser is the realistic Track C path. Plan for it on day one, not day three.

## Java / Kotlin — 25 LTS (25.0.4) (16 September 2025 · 25.0.4 on 21 July 2026)

Java 25 quietly became the best single-file language here. No build tool, no manifest, no ceremony — which lines up exactly with the Single File bonus.

New since you last looked:
- JEP 512 compact source files and instance main methods. void main() { IO.println("hi"); } in a bare .java file, with everything java.base exports auto-imported, run as java Hello.java. No build tool, no manifest, one file.
- JEP 511 module import declarations — import module java.base;.
- JEP 506 scoped values, a virtual-thread-friendly replacement for ThreadLocal.
- JEP 510 Key Derivation Function API — a standard KDF interface in javax.crypto.
- Java 26 (March 2026, non-LTS) added HTTP/3 to HttpClient via JEP 517.

Instead of installing it:
- OkHttp / Apache HttpClient -> java.net.http.HttpClient [since 11]
- commons-codec (hex) -> java.util.HexFormat [since 17]
- thread pools -> virtual threads [since 21]
- ThreadLocal -> scoped values [since 25]
- picocli (simple cases) -> String[] args [since always]
- commons-compress (zip/gzip) -> java.util.zip [since always]

Where the stdlib stops:
- No JSON in the JDK. Not one line of it. Either write a parser or pick Track B and make the parser the project.
- No JUnit. java Test.java with assertions and a main is your test harness.
- No SQLite, no YAML, no TOML.
- com.sun.net.httpserver exists and works, but it is demo-grade. Say so in your README.

## C# / .NET — 10 LTS (11 November 2025 · supported to November 2028)

File-based apps make C# a scripting language for the first time. The one real weakness is storage: SQLite is not in the box.

New since you last looked:
- File-based apps. dotnet run app.cs, or just dotnet app.cs, with no .csproj. A #!/usr/bin/env dotnet shebang makes it a cross-platform shell script, and dotnet project convert graduates it when it outgrows one file.
- File-based apps default to Native AOT, so use source-generated JSON ([JsonSerializable]) rather than reflection-based serialization.
- .slnx replaces the 2002-era .sln format; migrate with dotnet solution migrate.
- WebSocketStream for simpler WebSocket code, and TLS 1.3 for macOS clients.
- Post-quantum crypto: ML-DSA, Composite ML-DSA and HashML-DSA, plus AES KeyWrap with padding.
- System.Text.Json gains strict mode and duplicate-property rejection; CompareOptions.NumericOrdering; ISOWeek for DateOnly.

Instead of installing it:
- Newtonsoft.Json -> System.Text.Json [since Core 3.0]
- CommandLineParser -> args + switch [since always]
- RestSharp -> HttpClient [since always]
- BouncyCastle (common cases) -> System.Security.Cryptography [since always]
- SharpZipLib -> System.IO.Compression [since always]
- Serilog (console only) -> ILogger / Console [since always]

Where the stdlib stops:
- SQLite is not in the BCL. Microsoft.Data.Sqlite is a NuGet package, so Track D in C# means writing a storage engine rather than wrapping one. This is the single place .NET is weaker than Node, Python and Bun.
- xUnit and NUnit are NuGet packages. Your test harness is a main with assertions.
- No YAML, no TOML.
- HttpListener is the built-in server. It works; it is not Kestrel.

## C / C++ — C23 / C++23

The honest track. libc and POSIX give you sockets, files, threads and printf. Everything above that is yours to write, which is why "every line is mine" is literally true here.

Where the stdlib stops:
- No JSON, no HTTP, no TLS, no crypto, no compression, no test framework, no argument parser, no hash map.
- pthreads for concurrency, <stdio.h> and <string.h> for the rest.
- This is where the +5 Single File bonus is most natural, and where a 600-line program can be genuinely impressive.

# PER-TRACK GUIDANCE

## Track A — Developer Tools & CLI

What carries it:
- Argument parsing: util.parseArgs, argparse, flag, or a match over std::env::args.
- File walking: fs.glob (Node 22+), pathlib / os.walk, filepath.WalkDir, std::fs::read_dir.
- Colour without chalk: util.styleText in Node, raw ANSI escapes everywhere else. Honour NO_COLOR and check whether stdout is a TTY.

What sinks it: Shelling out to a tool you installed separately. That is a dependency you are hiding, and it is called out under Out of Scope.
Easiest in: Node or Go

## Track B — Parsers & Data Formats

What carries it:
- Error positions: keep a byte offset and a line/column counter from the first character. Retrofitting this on day three is miserable.
- Table-driven tests over a corpus of ugly inputs. node:test, unittest and testing all do subtests cleanly.
- If you write TOML, target the toml-test suite. If you write JSON, target JSONTestSuite. Judges can run those.

What sinks it: A parser that only handles the happy path. Escaping, nesting and malformed input are the whole grade here.
Easiest in: Any — this is the most language-agnostic track

## Track C — Web & Network

What carries it:
- Go and Node hand you a real server. net/http ServeMux gained method and wildcard patterns in 1.22, so you do not need a router.
- Go 1.25 added CrossOriginProtection to net/http — stdlib anti-CSRF, no middleware package.
- Go 1.27's httptest.NewTestServer gives you an in-memory network that pairs with testing/synctest for deterministic timeout tests.

What sinks it: Rust and C have no HTTP in the standard library at all. If you pick them here you are writing an HTTP/1.1 parser, and that needs to be day-one scope, not a day-three surprise.
Easiest in: Go

## Track D — Data & Storage

What carries it:
- Durability is the grade. fsync after append, or say plainly in the README that you did not.
- A log-structured store plus an in-memory index is the shape that fits in 72 hours and survives a restart.
- Hashing for buckets: node:crypto, hashlib, hash/fnv, std::hash.

What sinks it: Wrapping node:sqlite or sqlite3 and calling it a storage engine. It is legal, but Zero-Dependency Craft rewards the layer you wrote, not the one you called.
Easiest in: Go or Rust — and this is Rust's best track

## Track E — Security & Crypto Utilities

What carries it:
- Compose, never invent: node:crypto, hashlib / hmac / secrets, crypto/*, javax.crypto, System.Security.Cryptography.
- TOTP is roughly fifteen lines of hmac + struct + base32. It is the cleanest zero-dep security project in the field.
- Password hashing: scrypt and pbkdf2_hmac are in every stdlib here. Argon2 is not — say which you used and why.

What sinks it: Rolling your own cipher. It is an explicit rule, and it turns a strong submission into a disqualifying one. Rust is the trap: std has no crypto at all.
Easiest in: Python or Go

## Track F — Open / Wildcard

What carries it:
- The README has to argue the case: what would normally be imported, and what you used instead.
- Bun 1.4's new built-ins (Bun.Image, Bun.Archive, Bun.XML) open projects that were previously impossible with an empty manifest.
- Java 25 compact source files and .NET 10 file-based apps make single-file wildcard projects genuinely pleasant.

What sinks it: A stunt. "Reads as idiomatic and intentional, not a stunt" is in the track's own criteria — a clever thing nobody would use scores below a plain thing people would.
Easiest in: Whatever you already know best

# PACKAGE KILLER TARGETS (+3 BONUS)

The +3 Package Killer bonus wants a package people actually install, cleanly reimplemented and documented in STDLIB.md. These are already-verified targets. Bonus weight goes to the ones with real download numbers behind them.

- chalk (319.8M weekly) -> util.styleText() [Node]: Already in the box — kill it by writing the colour layer yourself and beating the API.
- readable-stream (185.6M weekly) -> node:stream [Node]: A back-pressure-correct stream implementation is a real Track B project.
- minimist (80.5M weekly) -> util.parseArgs() [Node]: parseArgs handles strings and booleans only. Subcommands and coercion are open ground.
- nodemon (7.8M weekly) -> node --watch [Node]: A debounced, ignore-aware watcher on fs.watch is a tidy Track A tool.
- itoa (crates.io staple) -> format_into + NumBuffer [Rust]: New in Rust 1.98 and benchmarked on par with the crate. The cleanest kill on this list.
- once_cell (crates.io staple) -> LazyLock / LazyCell [Rust]: Stable since 1.80 and still installed out of habit.
- google/uuid (Go staple) -> uuid [Go]: Moved into the standard library in Go 1.27, nine days before kickoff.
- @iarna/toml (—) -> Bun.TOML [Bun]: Or write a TOML writer for Python, where the stdlib deliberately has none.
- left-pad (the original sin) -> String.padStart() [any]: Only as a footnote inside something larger. On its own it is explicitly Out of Scope.

# FAQ

Q: What's the team size limit?
A: 1-4 people. Solo welcome. We recommend 2-3 for the 72-hour window.

Q: Can I use AI code generation?
A: Yes, and you should. Claude Code, Cursor, Aider, Copilot, all expected. We don't score whether you used AI; we score whether the artifact holds up and whether you can explain it. The README and STDLIB.md are the receipts.

Q: What languages can I use?
A: Any language with a standard library: JavaScript/TypeScript, Python, Go, Rust, C/C++, Java, Kotlin, C#, and more. The zero-dependency rules define "zero-dep" per language.

Q: What exactly counts as the standard library?
A: See What counts as zero dependency. Short version: whatever ships with the language runtime. Your compiler, build tool, and a stdlib test tool don't count against you. Third-party packages of any kind do.

Q: Does the C++ standard library count?
A: Yes. Containers, algorithms, <thread>, <filesystem> and iostreams are all in. The C/C++ line reads "libc and POSIX only" because that names the platform floor, not because libstdc++ or libc++ are banned. Every other language on the list gets its standard library and C++ is no different. Out: Boost, fmt, abseil, nlohmann/json, and anything pulled through vcpkg or Conan. Header-only libraries are still third-party, even with no link step.

Q: Can I use the package manager at all?
A: For dev-only tooling that never ships in the artifact (like a test framework, only if your language has none built in), yes, and you must disclose it in STDLIB.md. For anything the program runs on, no.

Q: Can my tool run git, CMake or another installed tool at runtime?
A: No. Invoking a separately installed tool is a dependency you would be hiding. Parsing files those tools already produced is fine, because nothing third-party ends up in your artifact. Two conditions: disclose it in STDLIB.md, and have the tool degrade gracefully when the file is absent rather than being useless without it.

Q: Can I read input from stdin?
A: Yes. Piping paths or data into your tool is standard-library I/O. You still cannot launch the tool that produced them yourself.

Q: Is vendoring a library's source allowed?
A: Only if you disclose it in STDLIB.md, and it will count against your Zero-Dependency Craft score. Copying a package's code into src/ to keep the manifest empty is not zero-dep.

Q: Can I start coding before August 28?
A: No code. Planning, sketching, reading standard-library docs, tuning AI prompts, all fine. Any project code committed before kickoff disqualifies the submission.

Q: Does a slower or more naive implementation score worse?
A: Not automatically. Honest and correct beats fast and hand-wavy. If your stdlib version is slower than the package it replaces, say so, that disclosure scores better than hiding it.

Q: What's the Package Killer bonus?
A: Cleanly reimplement a specific package people actually install and document the swap in STDLIB.md. Killing something with millions of weekly downloads carries more weight than killing an obscure one.

Q: Can I ship the whole thing as a single file?
A: Yes, that's the Single File bonus (+5), as long as it's still genuinely useful.

Q: What exactly has to be in one file for the Single File bonus?
A: The implementation. No src/ tree, no modules. Tests, docs, fixtures and build scripts can sit alongside it.

Q: What does the Reproducible Build bonus require?
A: Same machine, same toolchain. Build twice, publish both hashes, and the output must be byte-identical. Reproducibility across separate environments is not required.

Q: What if my language has a tiny standard library, like C or Rust?
A: That's part of the challenge, and judges weigh it. A capable tool built on a minimal stdlib is more impressive, not less. Track E aside, you're rewarded for doing more with less.

Q: What if I genuinely need one thing the stdlib doesn't have?
A: Then that's the interesting part of your submission: write it, and document it in STDLIB.md. The whole event is the discovery of how much the standard library already gives you.

Q: Does writing my own crypto break the rules?
A: Composing standard-library primitives is not rolling your own cipher. A Diffie-Hellman exchange, a real key-derivation step over the shared secret, and an XOR keystream is an acceptable composition. Three conditions: derive the key with an actual KDF (HKDF built on hmac, or hashlib.pbkdf2_hmac or scrypt), not a bare SHA-256 of the shared secret; never reuse a keystream byte; and authenticate the ciphertext, encrypt-then-MAC. Unauthenticated XOR still passes the zero-dependency rule, but it costs you under Code Quality & Idiom.

---
END OF CONTEXT PACK.

When answering: prefer the standard library, name the exact module or API, and say which
version it landed in. If the answer requires a package, say that plainly — the entrant needs
to know it is a dead end, not a workaround.

If this pack does not answer it, ask the organisers: https://discord.com/invite/xfYPDZYqeh