Comment by jhatemyjob

That's what I do for some of my dependencies. But it's only for legal reasons. If licensing isn't a concern, vendoring is superior.