Umm ... requirements.txt and pypi? Sbt/Maven/Gradle and maven/ivy repos? package.json?
Unless you setup a local caching, non-deleting, JFrog artifactory for all your dependencies (only jar files are covered in the free version BTW, and there aren't any tools that handle all those repo types in the OSS world), you are going to depend on external URLs.
This is why my build systems will only use release tarballs that can be cached. I built HashCache [0][1] to handle caching of these tarballs by their SHA-256, then the build system can fetch from there first to ensure a local mirror is available. My download process sometimes also caches into my home directory (into ~/.local/cache/by-hash/sha256/...) to avoid hitting the network at all if possible.
Also, some tools try to download things from the internet as part of the BUILD process. I also disable that using another tool [2].
Combined this really helps in being able to build my software when upstream goes away.
