@2a08d92699ec237569fa thanks for sharing your experience on Drupal ecoystem!
However « composer » is not a specific content, it’s just a developer tool (and not a mainstream tool) to grap the right version of a PHP module/library (and its dependencies). And… now 99% of PHP pieces of code is grabbed by Composer, because it is THE main and central way to be sure to download the right version of this or that.
And as the SPIP team is not so large, and doesn’t want to re-invent the wheel or maintain complex pieces unnecessarily, it’s logical to add dependencies to external libraries. For ex to send emails, to log errors, or any other things extremly well maintained by other teams in specific libraries.
Normally, you, as a websites creator/maintainer, you never have « to be responsible of hundreds of dependencies » : the only ones who are, are the maintainers of the software core you are using. Because if there is a new security issue or major issue inside a dependency, the core team will update the JSON, and will release a minor corrective version of the software, no ? So you just have to follow the releases of the software you are using.
In future versions, as you already noticed, SPIP will use more and more external PHP libs, in order to maintain only the specificity of SPIP. But we have to be careful that it must always be simple to install, and simple to extend (especially for frontend integrators).