I've said it before and I'll say it again (and this applies to other scripting language package managers too, e.g. composer for php): while "this public package

I've said it before and I'll say it again (and this applies to other scripting language package managers too, e.g. composer for php): while "this public package was unpublished" is probably something a package repo shouldn't support, the actual solution is pretty simple. Vendor your dependencies. By which I mean: commit the dependencies you rely on, to your VCS. It's really that simple. Yes, this probably requires some different usage or default behaviour from package managers to be "efficient" (i.e. you probably don't need to include all the tests, docs etc for each dependency in your repo). If you're following "best practices" for every library package manager I've seen (to commit their respective "lock" file, thereby fixing the used version of each dependency for subsequent installs), the end result is the same in terms of what version of dependency is available when the source is checked out - but now you have (a) zero risk of dependencies being pulled; (b) the ability to do comprehensive change reviews when versions are bumped; (c) likely faster updates for anyone pulling changes subsequent to a dependency change; (d) zero risk of 'install dependencies' related issues at deployment time.