I know it is not always possible but forking the repos helps mitigate the issue of original repo being "compromised". It also helps reproducible builds...
You don't need to do that with Go, go.sum stores the checksums and you can use go mod vendor to download the dependencies to your own repo.
That is not the point. If I newly checkout my Go project and build it, it will use my forked repos instead of the orginal ones.
If someone use my project, it will also use my forked repos, so it makes the builds more reproducible.
That way, I'm not pushing the dependencies in my project.
By forking the dependencies, I meant having a copy of them in my namespace, not cloning them in my project...
But then you end up with a 50GB+ npm /node_modules/-type situation. No thanks.
Sorry, I don't understand. My proposition is only to change 'origibal/dependency' to 'myfork/dependency'.