Home / Articles / The code you do not ship / Versions / v1.1.0
The code you do not ship: what changed in v1.1.0
From v1.0.0 (2026-10-18, de821285d) to v1.1.0 (2026-10-18, e9fbb78e9), paragraph by paragraph.
0 paragraphs added, 0 removed, 5 changed in place, 52 unchanged. About 3 words added and 0 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
17 unchanged paragraphs, under In short {#in-short}, Code is a liability {#liability}
It is not one case. ImageTragick in 2016 was remote code execution through ImageMagick coders most users never knew existed, and the published mitigation was to "use a policy file to disable the vulnerable ImageMagick coders." Heartbleed sat in OpenSSL's little-used heartbeat extension; the advice for anyone who could not upgrade was to recompile without it. Text4Shell (CVE-2022-42889) came from interpolators for scripts, DNS and URLs that were on by default, and the fix disabled them by default. OWASP put server-side request forgery in its 2021 Top 10 with a sentence that could be this article's thesis: "As modern web applications provide end-users with convenient features, fetching a URL becomes a common scenario. As a result, the incidence of SSRF is increasing." And James Kettle described template injection as arising from "the intentional exposure of templates in an attempt to offer rich functionality".
4 unchanged paragraphs, under Why it never scaled {#why-not}
The second is economic. Software companies were paid for new features, not for less. A new version had to look different to get people to upgrade, and a feature had to be visible for someone to keep paying for it. Nobody was paid for making a product simpler, or for maintaining what was already there. The evidence for how much of a product goes unused is weaker than it is usually quoted, so I will be careful with it. The famous figure that 64% of features are rarely or never used came from a Standish study of four internal applications. Pendo's 2019 analysis of usage data across its customers found that "80 percent of features in the average software product are rarely or never used", and that 12% of features generate 80% of daily usage; it is a vendor's data, and its categories make the 80% easy to reach. But the direction is not in doubt, and neither is the money: Pendo estimated that publicpublicly traded cloud software companies had spent up to $29.5 billion building those rarely used features. Meanwhile the maintenance nobody pays for is visible in open source, where Tidelift's 2024 survey found about 60% of maintainers unpaid.
2 unchanged paragraphs, under What changed {#changed}
The scaffolding is cheap. The bestmost useful thing models have done for my own engineering is not writing the feature. It is writing everything around it: the test harness, the fixtures, the environment that runs it all, the check that proves a change did not break the cases that matter. When that is cheap, removing code is safe, because you can prove what still works.
20 unchanged paragraphs, under The minimal viable code path {#path}, Who gets paid to keep it small {#market}, Why it matters more now {#now}…
Here is the part I think matters most. None of this will happen because it is more secure. Security has neverrarely been enough to make people use something.
9 unchanged paragraphs, under What this does not claim {#limits}, Where this comes from {#sources}
A voice memo from me on 18 October 2026. The measurement: the minimum code below, this site, 14 October 2026. The research, read on 18 October 2026: Apache Log4j release notes and LOG4J2-313; ImageTragick; the OpenSSL Heartbleed advisory;advisory](https://openssl-library.org/news/secadv/20140407.txt); Apache Commons Text security; OWASP Top 10 2021, A10.md); James Kettle, server-side template injection, 2015; curl's vulnerability data, counted by this site, and install guide; Azad, Laperdrix and Nikiforakis, Less is More, USENIX Security 2019; Soto-Valero and others, bloated dependencies in Maven; Drosos and others, Bloat beneath Python's Scales, FSE 2024; Mir, Keshani and Proksch, reachability in Maven; Endor Labs, 2024 dependency management report; Brown and Pande, Is Less Really More?; Pendo, 2019 feature adoption report; Mike Cohn on the 64% figure; Jerry Gamblin, 2025 CVE data review and monthly CVE stats; Anthropic, zero-days, February 2026; DARPA, AIxCC results; Daniel Stenberg, a curl audit by Aisle, 14 October 2026; Google, eliminating memory safety vulnerabilities in Android, 2024. Related: the eyeballs get cheap, the value of constraints, software vendors as villagers, three policies for an agent. Written up and checked by this site's agent; the editorial responsibility is mine.