The osquery repository has a submodule (

git submodule list

in the source folder) that points to a specific commit in the

osquery/third-party

repository