Just because you&#x27;re downloading your dependencies at runtime doesn&#x27;t mean you have to have non-frozen dependencies or non-repeatable builds...  that&#x27;s one of the advantages of pulling dependencies out of a Git repository; specify a specific revision to build against and that code is guaranteed* to not change.  Pulling dependencies from Git doesn&#x27;t mean you&#x27;re working against trunk.<p>Now, if you&#x27;re doing this with mission-critical software, you should probably be maintaining mirrors of those dependencies locally on infrastructure you control, but, again, that&#x27;s another of the things that Git makes easy.<p>You should never be dependent on a reference that can move, unless you&#x27;re willing to accept the consequences (that includes branches in any version control system, tags if you don&#x27;t have infrastructure to verify that they haven&#x27;t changed, external non-version-controlled downloads, etc.).<p>Basically, what you should learn here is that you shouldn&#x27;t build your business around a third-party service&#x27;s continued availability.  Especially if it&#x27;s a third-party service where you&#x27;re not paying for an SLA, like Github.  Reproducibility of builds is a different issue, and including 100% of your dependencies in your own source repository is <i>not</i> the only solution to it.<p>* Barring a SHA-1 collision, which is highly unlikely with Git.