One of our clients distributes a minicpan with his application. The user starts with a "run_me" file on the distro CD. That script configures CPAN.pm in memory (so it doesn't change or overwrite local settings), then installs everything from its own repository. Using CPAN::Mini::Inject and some other magic, we can add or replace any file.

It's certainly a pain when the external module authors don't acccept patches or can't be reached, but for most people they don't need to upgrade. That we might have to modify somebody else's code to deal with updates isn't all that worrisome: imagine writing all that code from scratch! We're in a pretty good place when that's our major annoyance. We've been living a pretty good life. :)