While vendoring is somewhat common (especially for C++ header-only libraries), often dependencies are provided by the OS package manager and dynamically linked

While vendoring is somewhat common (especially for C++ header-only libraries), often dependencies are provided by the OS package manager and dynamically linked (you have to recompile if the ABI changes, and hope that the API remains more or less stable, but that's usually part of the contract of a "major version").