In my opinion, yes, vendor-izing your dependencies is the way to go. My preferred way to do that is to use git subtree.