Unpopular opinion:

You should EXPLICITLY PIN your dependencies and SHIP THEM within your app.