[baby]

for read-only dependencies why not just vendor the dependency then? Or better, use a package manager at this point.