One issue with submodules is if they rebase and GC out the commit you're pointing to, you're going to have a bad time. This may not be a problem when pointing

One issue with submodules is if they rebase and GC out the commit you're pointing to, you're going to have a bad time. This may not be a problem when pointing to the commit of a stable tag, but when pointing to a development commit that might be rebased out later, you may find the submodule not to work. Not to mention if the server hosting the submodule is down and now all of a sudden you can't redeploy. One workaround is to fork the submodule and point to a commit in your fork.