Vendoring all your third party dependencies is fine, but you still have to build them. Personally I use the native build system that upstream uses for most of

Vendoring all your third party dependencies is fine, but you still have to build them. Personally I use the native build system that upstream uses for most of them, and just hack in my compiler flags/options where necessary. Then I use CI triggers to rebuild my projects when the dependencies are rebuilt.