In a world where dependencies are either delivered as source or through contract relationships with internet-connected businesses, I imagine that this is a norm

In a world where dependencies are either delivered as source or through contract relationships with internet-connected businesses, I imagine that this is a normal thing. In the past you got code shipped to you on CDs. Today, I can get my dependencies via a network request. If you don't have the ability to rebuild or otherwise get updated dependencies, you've got problems beyond ABI stability. "I cannot rebuild my dependencies" is unacceptable from a vuln management perspective, for example.