> But having your own copy of all dependencies (current and past) is necessary.

Definitely! Git mirrors are cheap, and there are various solutions for composer proxies out there. If you consider CI/CD you will want freedom from external calls anyway.