I’m not so sure that vendoring is the way to go. APIs are a contract between the parties and should be immutable once they achieve production status. The APIs should be layered away from the underlying processes or business. While not everyone believes in this contract style you could or should impose that layer yourself. In this way your application will not experience a total collapse if there is a 3rd party change. Vendoring can be expensive during the build step. It’s expensive on the VCS system. Requires considerable effort to update. And in the end it’ll come down to your testing anyway.