When you check vendored code into VCS, that code is no longer tracked in its own git repo (since you must remove the .git directory to check it in, or else treat it as a submodule). We thus lose all of the assistance the VCS was giving us. This leads to three problems:
-
Updates require full checkouts every single time. Any time you need to update a dependency, you have to check out that dependency, along with all of those that it requires. Then you must do all the version management, only to remove most of what you checked out at the end. The unfortunate result is that for many teams, they never update vendored packages, and security and stability issues go unnoticed. For us, one of our core dependencies is Kubernetes. So updating that one dependency requires checking out around 200 additional packages. Thus, updating is a non-trivial (quite time-consuming) task.
-
Working with dependent packages is harder. Say I have two packages: A and B. And A depends on B. Working on problems b