Policy with dependencies

[miguelmig]

I'm working improving an existing autocomplete spec, but it requires parsing a toml file.

So I'm wondering what is the policy behind adding dependencies to package.json here