You also won’t typically find C/C++ developers blinding yolo’ing the latest version of a dependency from the Internet into their CI/CD pipeline.

They’ll stick with a stable version that has the features they need until they have a good reason to move. That version will be one they’ve decided to ship themselves, or it’ll be provided by someone like Debian or Red Hat.

Unless of course they are using vcpkg, conan or FetchContent.

Most corporations are already using the likes of Nexus or JFrog Artifactory, regardless of the programming language.