Can't you just take a snapshot of the source including third party libs and keep it somewhere safe? That's what vendoring is for — freezing your dependency on

Can't you just take a snapshot of the source including third party libs and keep it somewhere safe? That's what vendoring is for — freezing your dependency on some version. What StableLib provides is a guarantee that the API of package remains stable, but also that all the latest major/security bugs are always fixed (by backporting them). Also, that you're always notified about any critical/security fixes. Of course, you can also do vendoring with StableLib-provided packages, and we plan to make it easy via the command-line tool.