It’s generally a best practice to put your dependencies into the same source control as your “actual” project.
And by “best practice” I mean “something everyone learns after they get burned once,” kind-of like “making backups” or, indeed, “using source control.”