This is one of the reasons I like the Nix package manager—I can use Nix to de facto vendor dependencies (at least in the sense of having a local copy where I fu

This is one of the reasons I like the Nix package manager—I can use Nix to de facto vendor dependencies (at least in the sense of having a local copy where I fully control the version we're on) without the attendant Git/build tool/etc hassle. If anything, a Nix derivation with a hash is going to be more reliable than a git commit hash even when you control the repo because it forces the build of your vendored dependency (including any transitive dependencies) to be deterministic. The downside, of course, is that it can be a lot of effort to retrofit deterministic builds on top of external codebases not built with that in mind...