It depends on the use case. Taking responsibility for your dependencies need not be that big a deal: if you trust the upstream then automate a pull. Then you're

It depends on the use case. Taking responsibility for your dependencies need not be that big a deal: if you trust the upstream then automate a pull. Then you're set up to turn it off and deal with issues at leisure when they arise. There's tradeoffs, as there are in all things. It's not always the best idea; but neither is "lets just dynload it off a URL at runtime" neither.