If we copy and past snippets of code between packages, we lose out on potential code de-duplication from dependency flattening.
If you're really worried about your dependencies disappearing/changing beneath you just check them into git.
For those who go this route, any advice on what you can do to keep your version control history from blowing up?
So instead of checking in your dependencies into your app repo directly, you turn your dependencies folders into submodules to keep their histories separate from your app repo's history.
Makes sense! I'll be sure to give that a try on my next project.
There's a bit of extra overhead because you have to fetch them separately after cloning a repo, and updating them is separate from pulling origin/master. If you do one without the other you can probably get into unexpected version mismatches where your project doesn't play nicely with the dependencies.