> If we can agree living at HEAD is preferred having a communal vendored third_party seems like a clear win.

“It has been 0 days since a minor version update in a third-party library has broken my code.”

This is just a fiendishly difficult problem to solve.