This is why we should maintain our own pypi repository. Your external dependency did nothing wrong.