or vendor them and state the dependencies explicitly with require()s