This strategy means you depend on the upstream to keep the version stable. In general, URLs do not imply a stable version.

Vendoring your deps is currently the only certain way to get stable versioning.