This might have been an unpopular opinion 10 years ago. But since then, we have supply-chain attacks, and we have left-pad. I think vendoring or mirroring all d

This might have been an unpopular opinion 10 years ago. But since then, we have supply-chain attacks, and we have left-pad. I think vendoring or mirroring all dependencies is starting to become standard practice nowadays. At the very least, I think it's generally a good idea to pin all dependencies to the exact version.