Why vendoring is not a common practice baffles me, especially since the leftpad incident happened over 8 years ago. For Python, you can use `pip wheel` (https:

Why vendoring is not a common practice baffles me, especially since the leftpad incident happened over 8 years ago. For Python, you can use `pip wheel` (https://pip.pypa.io/en/stable/cli/pip_wheel/ https://pip.pypa.io/en/stable/cli/pip_wheel/) to download .whl files of your dependencies in a folder, add that folder to your version control, and update `sys.path` to include your .whl. For updating packages, you run `pip wheel` again and check in the new .whl files after carefully review the changes.