Indeed. It’s perfectly possible and recommended to run Artifactory or similar as a local mirror anyway to buffer upstream unavailability/slowness. (Beyond Maven

Indeed. It’s perfectly possible and recommended to run Artifactory or similar as a local mirror anyway to buffer upstream unavailability/slowness. (Beyond Maven it also does npm, pip, and I think deb and more via pluggable layouts). I don’t know if it has machinery to propagate upstream deletes, but if so there should be a switch to maintain a cache in any case if the license is irrevocable. It’s also good practice to locally mirror source of all dependencies. Gogs is light and runs in Docker and allows this. It would be good practice to ensure that builds can be made and published locally. Finally legal knows what is in use and probably has a whitelist of acceptable licenses and irrevocability should be a criterium. CI really shouldn’t need to hit 3rd parties. That’s a service that NPM does not disincentivize afaik, but respecting author takedown requests would certainly do so. I agree it’s npm’s call how they want to manage their relationships and what service level agreements they offer, even tho they are covert agreements to most. A pattern of high profile takedowns would make it known. Businesses are to make money and CI management is ultimately the responsibility of each org.