So vendor in the dependencies. it's a matter of cloning the dependencies repo and adding a handful of characters to your project's cargo file. Now the lifetime

So vendor in the dependencies. it's a matter of cloning the dependencies repo and adding a handful of characters to your project's cargo file. Now the lifetime of the dependency is that of your project. There's even tooling 'cargo-vendor' to help manage this setup. Alternative of course is implementing it all yourself, which cargo doesn't prevent.