This took me by surprise too. For some reason it isn't happening in the Vagrant VM I develop on, but now I've run it on my VPS, it's totally there! exa uses libgit2 which must be requiring it somehow.

The GitHub issue offers a fix for Ubuntu: https://github.com/ogham/exa/issues/194

Just make sure you update exa when there's a vulnerability in whatever got statically linked to it.

In general, they could. As always, it's a tradeoff. See the above thread about binary size...

Is there a reason it has an http parser?