This is called “vendoring” your dependencies (taking a snapshot into your SCM), and has been common practice for about 30 years. Long before NPM and other language-specific package managers.

Tools for managing vendor branches or sub-trees abound, but good old svn:external and scripts work for most use cases.