This has happened so many times. At this point I have no sympathy for those affected. Vendor your dependencies.