Well… the authentic answer is I don’t worry, because I roll my own everything. I’m cool like that.
However! I do reference a lot of data sources, sometimes from git repos imported as go modules/git sub-modules/filesystem, and sometimes run into this issue. The reason I lean on git as VCS is because I can then pin to a tag or other release marker, to a version that I know works.
The reason I mirror is because git is meant for sharing, and syncing is surprising efficient. And from my personal experience: a repo is more likely to disappear from the origin repo than break something without me noticing.
Take my advice with a grain of salt, nearly everyone’s site is more complex than mine. I’ve no idea how folks track the various components they import and process and…