The dependencies will be downloaded at build time, based on the contents of `package.json` and `pnpm-lock.yaml`. You should verify the new set of packages don't break anything before committing.
Make sure to enter license information for new dependencies, as specified in `docs/dependency-license-information.md`. Javascript dependencies are included as `other` elements.