Dependency management

CONTRIBUTING.md

@@ -162,3 +162,31 @@ Including the `--verify` flag will verify deployed contracts on Etherscan. Defin
 ```shell
 forge script script/Deploy.s.sol --broadcast --rpc-url <rpc_url> --verify
 ```
+
+## Dependency Management
+
+The preferred way to manage dependencies is using [`forge install`](https://book.getfoundry.sh/forge/dependencies). This ensures that your project uses the correct versions and structure for all external libraries.
+
+However, in cases where there is a Solidity version mismatch between your project and a dependency, you may need to include the compiled bytecode directly in a utility contract. This approach allows you to deploy the dependency using the correct bytecode, regardless of source compatibility. This may be especially helpful for integration testing.
+
+First, check if the deployer is already part of [Briefcase](https://github.com/Uniswap/briefcase/tree/main/src/deployers). If so, import the deployer from here.
+
+Otherwise, you'll need to create a custom deploy contract. Below is an example of how to deploy a contract using hardcoded bytecode and the `CREATE2` opcode:
+
+```solidity
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.24;
+
+contract BytecodeDeployer {
+    /// @dev Deploys a contract using CREATE2 with the provided bytecode and salt.
+    /// @param bytecode The contract bytecode to deploy.
+    /// @param salt The salt to use for CREATE2.
+    /// @return addr The address of the deployed contract.
+    function deploy(bytes memory bytecode, bytes32 salt) public returns (address addr) {
+        require(bytecode.length != 0, "Bytecode is empty");
+        assembly {
+            addr := create2(bytecode, salt)
+            if iszero(extcodesize(addr)) { revert(0, 0) }
+        }
+    }
+}