> I don't see any of those as reasons to commit dependencies to the same VCS repo your source control lives in. Why not? What's the downside except having a "u

> I don't see any of those as reasons to commit dependencies to the same VCS repo your source control lives in. Why not? What's the downside except having a "update dependency" commit from time to time. It's a great solution to always have your dependencies at hand, offline and even versioned. Makes it easy to see when a bug got introduced by a dependency or roll back an update. Especially for projects that don't have a build pipeline, cached dependencies or just smaller dependencies that aren't very well backed up from other people. I think it's a great way to make sure things are still running after a few years (personal projects) and everything still works without having to hunt down some dependencies or find alternative mirrors.