Unfortunately you can't please everyone, but I think your approach is the safer one, and it's ok to put your foot down, it's your project after all. The people

Unfortunately you can't please everyone, but I think your approach is the safer one, and it's ok to put your foot down, it's your project after all. The people who would care so much about external dependencies may not be the ones you want on your side anyways. The only middle ground I can even think of would be something like using git submodule/subtree/subrepo where the user can choose to either not even clone those parts (or somehow exclude them altogether) in order to use the system libs, or be able to update the dependencies themselves if they don't want to stay on your known-working versions.