> Adapting Leslie Lamport’s observation about distributed systems, a dependency manager can easily create a situation in which the failure of a package you didn’t even know existed can render your own code unusable.

Gold right here. Makes me wonder what Lamport’s TLA+ could be used for in the problem area.