Most systems have package managers with versions and a central repo and dependency tracking. Problems with fetching builds are rare but if you care package man

Most systems have package managers with versions and a central repo and dependency tracking. Problems with fetching builds are rare but if you care package managers frequently have some not exactly recommended plugin to allow vendoring. Plus with the package manager you can update the optionally vendored dependencies quickly. Central repos are less likely to be deleted then github repos and some like Crates.io have a policy not to remove crates(or allow authors to remove crates) unless there are legal issues. A better solution (then vendoring) for larger organizations that is also usually available in the form of mirroring or partial mirroring of the central repository(and pulling from that instead).