Vendoring is terrible for security. Distribution maintainers, developers and system engineers have to either unvendorize everything or go through all vendorize

Vendoring is terrible for security. Distribution maintainers, developers and system engineers have to either unvendorize everything or go through all vendorized dependencies every time a vulnerability comes out and patch them. Most live systems cannot receive a full upgrade every time a patch is published. Use dynamic linking on languages that support it and don't vendorize things.