I would say that it should be listed as a dependency of the npm package as this would make it automatically install for the user. It would be a bit strange to also make them install `validate.js` in addition to the stimulus library.