I also think reproducable builds are very important. Vendoring has solved this for me in Go even before it was officially supported.

My main fear is that when people get used to the idea that their master repo doesn't have to have a backwards compatible interface, then updating dependencies will look awfully similar to NPM where authors change interfaces based on their weekly mood.