You have to vendor. There is no other way. Or you pay the cost of vendoring at deploy time by having to pull in all the third party dependencies anyway. Whenever I rely on the end user or the platform to fill in the blanks I always regret it.