It puts you in the driver's seat of dependency managing, but now you have to be a lot more careful to actually update them when the time comes. If you tend to p

It puts you in the driver's seat of dependency managing, but now you have to be a lot more careful to actually update them when the time comes. If you tend to put something into production and leave it there for months / years, coming back to do maintenance will be a real chore. With Ruby I can 'bundle update', run the tests, and have reasonable certainty that everything's working. If I took over a Ruby project with vendored gems I'd mark them all for replacement for standard Bundler-managed gems at first opportunity. Vendored code has a bad tendency to become 'unmaintained code' otherwise. Just because it works and is stable doesn't mean it doesn't have security vulns.