Vendoring as practice isn’t common in some ecosystems (ruby, JavaScript, python, Clojure), but I do see more people using caching proxies and services like JFro

Vendoring as practice isn’t common in some ecosystems (ruby, JavaScript, python, Clojure), but I do see more people using caching proxies and services like JFrog’s to ensure they always have access to particular versions of a dependency. Sadly, this still doesn’t fix non-repudiation problems we see in ecosystems that don’t enforce things like package signing.