Golang, where it is (or used to be) a common practice, even has special tooling for this, and dedicates the "vendor" directory to that.