**@dom96** The idea is that any release zip of source code would contain the vendor libraries. Most of the time you wouldn't check them in.
The NuGet package manager for .net does something similar (as does nom), in that packages for a project are local to the project, and stored in a "packages" folder. The NuGet package system relies on centralised package feeds though, rather than decentralised Git repositories. A good lock format would solve the concerns that vendoring solve for definite though. Both approaches aim to solve the same thing in the end
