Vendoring is the concept of downloading/installing a specific version of dependencies and making it available elsewhere (typically, within a local repo/folder of your supporting application)
Vendoring is usually done to prevent breakage occurring when dependences are no longer available. Vendoring also prevents your applications from breaking when dependencies are no longer available( for ex: the leftpad incident)
For example, let's consider you have your Chef cookbook that depends on another third party cookbook, say mysql2 chef gem. Now while mentioning in your metadata.rb
, you didn't pin the version or vendor the cookbook. Lets consider the cookbook has had a version upgrade, breaking all previous APIs. The previous versions have also been taken down. In such a case, your cookbooks are suddenly broken as well and if you have a urgent deploy, your Chef run will fail.
Vendoring prevents this by making available the dependency on your local chef server, so even if the dependency has gone ahead, you can continue referring to the previous version and your cookbook will not break
(Also goes without saying, you must keep updating the dependencies and cookbooks, else you might get bit with some bad bugs)