[DoctorNick]

Exactly. Unless the package manager has a mechanism for doing that, good fucking luck updating any of your packages ever again.

[viraptor]

It is implemented pretty well in a few languages. For ruby for example it's almost trivial to maintain a `vendor` directory that matches the current `Gemfile` and `Gemfile.lock`. The size changes without LFS mean that's a bad idea, but... you can do it.