Personally, I'd prefer to let CPAN do the source-control on those modules and install the specific version of a given module in each place. For example, you could either d/l the correct .tar.gz or do "install XXX 1.234" within the CPAN module.

The problem with this approach is that you cannot trust CPAN to have that version available. Old modules are deleted on a regular basis by their authors (I certainly do). I have a vague memory of this being a "best practice" documented somewhere, but I can't locate it after five minutes googling so I may be mis-remembering.

Yes, there are things like backpan, but now you have to deal with CPAN, backpan + your own modules. I'm in complete agreement with chromatic, keeping everything in source control makes development much easier IMHO.

My /vendor directory of my current project includes all third party modules, plus perl, apache, mod_perl, openssl, and all other third party code. I want everything that I need to build my project available locally and under source control so that I can access it easily at any point in the future.