I started seeing the floating dependency approach at smaller places and personally consider it a bad pattern.
You get everything you depend on, stuff it into a folder named third-party, and check it in forever (or until security bugs, features you need, etc). Include all and any licences, this is important.
When dealing with any software that's supposed to be our there for decades, the last thing you want it to have unplanned work because of missing libraries.
I have seen this first hand at a acquisition. Missing licenses resulted in the entire FE team working in finding missing licenses/find alternative module with proper license or worst case scenario; implement our own solution. This literally took 1 week. Shrink-wrap would have saved us a bunch of $$$.
Yes, it takes one to go through that experience once, to fully appreciate the effort. I also look at that one downvote to my post, and can't help but think that somebody is up for a very nasty surprise in his career.
You get everything you depend on, stuff it into a folder named third-party, and check it in forever (or until security bugs, features you need, etc). Include all and any licences, this is important.
When dealing with any software that's supposed to be our there for decades, the last thing you want it to have unplanned work because of missing libraries.