Copying two hundred lines out of a dependency, and the three things that make that legitimate rather than theft.
/**
* Adapted from foo-utils v3.2.1
* https://github.com/example/foo-utils
* Copyright (c) 2019 the foo-utils authors
* MIT — see vendor-licences/foo-utils.txt
*
* Changes: removed the streaming variant and the
* Node-only path. Upstream commit 8c1f4a7.
*/The licence file, the upstream commit hash and the list of changes are what make this maintainable — without the commit hash there is no way to work out what upstream fixes apply. The test is the fourth thing: vendored code has no upstream test suite protecting it, so it needs one of its own, and writing it is how you find out whether you understood the two hundred lines.