vendored

Vendored is the past participle of vendor, used as an adjective and noun in business and computing. In general, it describes goods or services supplied by an external seller. In software development, vendoring refers to embedding external code or assets within a project’s repository, typically under a directory named vendor, in order to provide a fixed, self-contained set of dependencies.

Vendored dependencies are intended to guarantee reproducible builds, offline access, and isolation from upstream outages or changes. Common in various ecosystems, vendoring involves including library sources or assets directly in the project rather than relying solely on an external package registry at build time. Examples include languages such as Go and PHP, which commonly use vendor directories to store libraries.

There are drawbacks: increased repository size, duplicated code across projects, and potential licensing or security concerns if the vendored copy is not updated. Managing updates to vendored code can be more labor-intensive than relying on dynamic dependencies. Teams may employ tools to track licenses, ensure provenance, and automate vendor updates, or prefer modern package managers that balance vendoring with centralized dependency resolution.

Etymology: from the verb vendor, meaning to sell; vendored describes goods or code supplied by a vendor. In common language it can describe physical goods, while in software it denotes code explicitly included in a project for stability and portability.