Once you've fetched dependencies with mdm, the files are from the linked releases are dropped in your working tree.
They're also locally cached in git objects -- if you modify them, you can git checkout in the submodule to revert them, and all that good stuff.
If switching between two branches with different dependencies, after the first download, every subsequent mdm update on either branch is a fast, purely local zero-network operation.
If we assume your dependency is linked in a directory called lib/{depName}/:
- the actual dependency files are in directories under
lib/{depName}/. (You knew that already.) - the git data dir (the one that contains the compressed delta'd objects, refs, etc) is under
.git/modules/lib/{depName}/. (Notice how this is inside of your project repo's.git/dir instead of in the working tree. This means that even when you nuke-n-pave your working tree, the compressed delta'd forms of dependencies you'd previously fetched are still here on your local disk.) - the url to the remote git host of the dependency repo is stored in
.git/config. (This is a feature of git that allows local overrides to be made to repo urls. It is pretty redundant by default, but it's perfect if you want an advanced situation like a full cache of http://mdm-releases.com/ on a host in your LAN or even local filesystem, for example.)