[Deps] remove function-bind dependency

[Conaclos]

Hi!

Close to 90% of the bundle size is due to function-bind dependency. By removing this dependency, the package is lighter and we save bits for the planet :)

[ljharb]

This causes the package to be broken when someone does delete Function.prototype.call later.

[zloirock]

If someone will delete Function.prototype.call, your Node application will die anyway since it's used in Node, most likely your browser application will die too. Moreover, functions created by function-bind will not work - see the source code of function-bind implementation. And I still didn't say about delete Function.prototype.call before has loading.

[ljharb]

There’s no defense from first-run code.

That node breaks in this case doesn’t change that browsers don’t, and this package (like most) is designed to also run in the browser.

[ljharb]

There’s also no way to defend against .call deletion in an engine without a native bind - so the current state of the package is the best possible balance of robustness and correctness.

[Conaclos]

@ljharb
I'm not sure to understand the reasoning...

In a sense my proposal reduces the attack surface.

In the current implementation, if Function.prototype.bind is undefined (potentially deleted), then the code can be "attacked" by redefining Array, Function, Object, Object.hasOwnProperty, Function.prototype.call, Function.prototype.apply, Array.prototype.concat, or Array.prototype.push, Array.prototype.slice. Otherwise the code can be "attacked" by redefining Object, Function, Object.hasOwnProperty, or Function.prototype.bind.

In contrast the proposed change reduces the attack surface at the redefinition or deletion of Object, Function, Object.hasOwnProperty, and Function.prototype.call.

[ljharb]

It is always assumed that the module is evaluated in a clean realm (because nothing else is remotely defensible) - meaning, Function.prototype.bind either exists (native, or polyfilled) or does not. In the former case, function-bind just provides the native method. In the latter case, you’re right that https://unpkg.com/browse/function-bind@1.1.1/implementation.js has a number of attack surfaces at runtime - but the solution is to harden that package, not weaken this one.

[Conaclos]

@ljharb
Thanks for the explanation. This makes sense.