False dilemma much? Private versions of most dependency repos exist (npm, maven, etc)