Another reason is what if upstream deletes the package? What if github goes down? Still, maybe we are better off vendoring packages. At least that would make

Another reason is what if upstream deletes the package? What if github goes down? Still, maybe we are better off vendoring packages. At least that would make us consider our use of deps.