The library **bundles** libsecp256k1 and a bunch of other libraries. When one includes 10 libraries in the repository, it's not zero deps. It's misleading to call it "zero dependencies" in README and docs.