Everything

Nine bundled CLIs, zero static links: an OpenSSL CVE becomes a file copy, and the parser is the bill

A desktop app that shells out to openssl.exe and ffmpeg.exe can absorb a CVE with a few-megabyte drop-in. The author is unusually clear about the price: spawn latency, and a parser per tool.