That's one big reason my company deploys everything through a devpi proxy. Not only can I blacklist versions, override with our own patched versions... But can

That's one big reason my company deploys everything through a devpi proxy. Not only can I blacklist versions, override with our own patched versions... But can also guarantee if I installed it during testing, it'll be there in production. (Also, updating production isn't affected by pypi / GitHub / etc going down). Devpi has its own design issues, but certainly a reliable and workable solution.