understanding submodules has not caused me to stop wishing that something in the vein of nix (in the sense of being able to provide a "lockfile" that transcends language-level package managers) becomes sufficiently commonplace that people would feel silly doing anything other than using whatever that turns out to be, or just directly vendoring if all else fails