Factoring in vendored dependencies as part of transitive dependencies #847

With regards to framework dependency count: https://frameworks.e18e.dev/dev-time/#dependency-counts

Sometimes a package will include dependencies as part of their distribution, without including it in package.json#dependencies. For example, such packages may not appear via npm ls, and using npm audit won't reveal vulnerabilities of vendored packages such as this vercel/next.js#83459.

From what I gather, vendored packages for Next.js can be found at: packages/next/src/compiled.

It would be great to have a deterministic way to reveal the number of vendored dependencies each framework has as part of the benchmark, and to represent them in some way as part of the total dependency count.