Bumping vendored dependencies in a repository

I have a love/hate relationship with vendoring dependencies in a repository. This enduring trauma and admiration comes from many of the projects I’ve supported over the years. Vendoring is a terribly convenient pattern, doubly so when the upstream source of that dependency could be unavailable when/where you’re running that project. Corporate firewalls or proxies, unstable connectivity on cu...