[SchizoDuckie]

and this, kids, is why you check in your dependencies with your project. You can refer to them in your vendor folder for fun, no problem. BUT KEEP A LOCAL COPY IN YOUR REPO

This is for Composer, as wel as for NPM. You now introduced a third-party dependency into your development workflow. What will you do when github goes down for a week?

[akerl_]

Or... just keep a clone of the upstream repo right next to your project's repo.

I'm all in favor of removing the runtime dependency on GitHub and similar, but that doesn't inherently require keeping deps in the same repo as the project.