Well, in my experience you cache those dependencies via something like jfrog. That helps. But yeah, dependencies require maintenance.