[schonfinkel]

I once worked in a project that vendored most of its third-party dependencies, it was a culture shock at first, but damn, after a while it was so nice being able to work just by building from local source, with normal tooling like `make`, instead of pulling a shitton of deps from the outside world. Made me realize how much "webdev culture" did a disservice to software engineering as a whole.

[nijave]

Caching proxies are a decent middle ground like Artifactory. AWS might support that (maybe only on certain repo types?)

Generally you can also configure rules in your internal package cache about what to do if a package is missing from the cache/hasn't been pulled yet. They also commonly integrate automaticaly CVE tracking and pull statistics so they give a nice "heads up" what everyone is using even if it's a local PoC

As an added bonus, they can also lower bandwidth bills like in expensive cloud environments when you can co-locate the proxy close to CI/build machines.

[schonfinkel]

or you can throw all of this into the trash and just use Nix.

[nijave]

The parent is about vendoring dependencies which Nix does not do by default so that is not a solution here.