I'm using subtrees to vendor C dependencies and it works well. Submodules are problematic as they may disappear or the git repo might be down. If your dependency is read only, subtree is a better option IMO.