Comment by nc0

So much thought works for not accepting the only real, future-proof, safe, and deterministic solution that is downloading your dependencies' code next to your code forever (a.k.a. vendoring)....