> You've got to vendor everything too Well I hope people do this Not necessarily have a downloaded carbon copy of every dependency, but at least enough inform

> You've got to vendor everything too Well I hope people do this Not necessarily have a downloaded carbon copy of every dependency, but at least enough information to recover it. package-lock.json file for example. NB. I added a script to backup node_modules of every CI build. Just for paranoia.