It not only is possible to vendor all the dependant code, it is (under executive order dum de dum de dum) required to provide a software BOM in USA (and by exte

It not only is possible to vendor all the dependant code, it is (under executive order dum de dum de dum) required to provide a software BOM in USA (and by extension more or less everywhere) Most companies think that they can outsource this to say Tidelift and just keep treating it as a free gift from the global community But as long as there is not a precise definition of your software stack (I am thinking something like nix plus repeatable software builds) then there is nothing the global community can do (because unless we know your stack precisely who can say what vulnerabilities exist) I think there is an interesting new industry - software dependency provision - imagine being able to define the complete set of software, where and how it was compiled, probably using something like nix.