[ruskyhacker]

Idk how I feel about this. I think this is only an appropriate solution if you are 100% capable and can take complete ownership of patching said dependencies.

I get how there is risk associated with a supply chain attack, but what are you going to do when you don't understand a vulnerability and need to fix it?

Most problems aren't impossible to solve of course, but those who've been working with a codebase for a long time probably have a more intimate knowledge of how it works.

[cyanydeez]

Better option is to proxy the package manager and then you can always upgrade and store those.

Its also acts to speed up testing and deployment