Please be extra careful when adding new dependencies. Our build is setup to allow transitive dependencies, so reviews should include looking at the tree of transitive dependencies that a new dependency pulls into Geode.
I think it would also be a good idea to create a little extra noise on the dev-list about the new dependency before you file a PR that adds it. Maybe, explain what the dependency is, how it'll be used, whether or not it's part of the distro, what transitive dependencies it might pull in, etc. Thanks, Kirk