If you have these requirements, why not vendorize all your dependencies?