> there should be an easier way to "pin" a dependency, other than vendoring

You left out the part that explains why.