The only difference is that finding the dependencies can be a pain if they changed location, or github is down, or the specific version isn't a specific git com

The only difference is that finding the dependencies can be a pain if they changed location, or github is down, or the specific version isn't a specific git commit or something like that. Since there's no real difference, it doesn't really matter if you check in deps or have specific versions in a config file, either solution solves the underlying problem of having non-precise dependencies (i.e. just a github repo, or a version selector like >= 2.6)