Most of the golang ecosystem, I think. Not to mention any other language-specific package managers that support pulling from GitHub...

I remember the CocoaPods debacle of 2016.

[0] https://news.ycombinator.com/item?id=11245652

[1] https://github.com/CocoaPods/CocoaPods/issues/4989#issuecomm...

And I was thinking JS/npm, not even golang.

Golang can be the biggest offender in this regard because you import by typing the URL to a github repository... Better hope someone mirrors those projects if they ever go poof. It's not even a generic import to a package[0]. Gotta be fun to have to update all those imports later if a project moves to another host to avoid Microsoft.

[0]: https://godoc.org/github.com/lib/pq

Well that's the beauty of git, as long as anyone anywhere has a checkout of the Repository nothing will be lost. If tags are GPG signed you don't even have to put any trust in the surviveing source. That said for mantained code 99.9% of the time you would just use one of the core develops local copies.

Except for issues and pull request metadata, which are important part of the project knowledge.

In SIT (decentralized collaborative information tracker, https://sit.fyi) there's an issue tracking module and an import tool (https://github.com/sit-fyi/sit-import) that allows to convert all issues and PRs into self-contained issues that can be worked with using SIT issue-tracking, so at least there's a relatively smooth way out to decentralized issue tracking.

It's a good thing computers are good at search and replace.

and since the standard library includes a parser for go you don't even need to do it textually