[aianus]

At least for Ruby, it was easy to pin a specific commit SHA in the Gemfile to guarantee immutability.

[koolba]

That does not guarantee it exists at the source repo though. You can’t create different content at that same hash, but you can rewrite history or delete the branch of that hash entirely and it will eventually be GCed away.