You are required to comply with all the licenses that apply to the different code parts that make up your project, including the licenses on transitive dependencies (dependencies of dependencies and deeper). If there is a transitive dependency with a license that states that all source code of the entire project must be available (like the GPL license does), then you are required to make sure that all source code actually is available.
But, a requirement for have the source code available does not necessarily mean that it must be available from your repository or server, unless the license explicitly states so.
Most licenses allow that if you use the software unchanged (which would be the case if you use a package manager to retrieve an official release), then you can refer your users to the location where you would retrieve the source code of that package from.
For your direct dependencies, it will normally be enough that you include a link to their repository and/or homepage in your documentation. This is a good thing to do even if the source-code disclosure doesn't mandate it.
For transitive dependencies, you can either treat them as direct dependencies (I would recommend this for dependencies with a strong copyleft license, unless they are coming in through a dependency that already has such a license), or check that there is a path through the sites/repositories of your dependencies to their source code.