Just use software that is in Debian stable. If a library is not in Debian, then pack it and become a Debian developer and solve that problem for you and thousands of other people that are affected.

Software supply chain is a very old Problem and already solved. No need to reinvent the wheel for each generation of software developers.