Which is why you pin dependencies to specific versions.
> - the host is down so you can't compile your own code because your dependency is not available
Which is why you have (caching) proxy and use mirrors.
> - the host is hacked and "foo" was replaced with "malicious foo"
Which is why you use GPG signing. (sadly, Python lacks in this respect).
> - exponential increase of testing (you really should test with all version of your dependencies you use)
Which is why you only use a specific version.
Which is why you pin dependencies to specific versions.
> - the host is down so you can't compile your own code because your dependency is not available
Which is why you have (caching) proxy and use mirrors.
> - the host is hacked and "foo" was replaced with "malicious foo"
Which is why you use GPG signing. (sadly, Python lacks in this respect).
> - exponential increase of testing (you really should test with all version of your dependencies you use)
Which is why you only use a specific version.