It puts you in the driver&#x27;s seat of dependency managing, but now you have to be a lot more careful to actually update them when the time comes. If you tend to put something into production and leave it there for months &#x2F; years, coming back to do maintenance will be a real chore.<p>With Ruby I can &#x27;bundle update&#x27;, run the tests, and have reasonable certainty that everything&#x27;s working. If I took over a Ruby project with vendored gems I&#x27;d mark them all for replacement for standard Bundler-managed gems at first opportunity. Vendored code has a bad tendency to become &#x27;unmaintained code&#x27; otherwise.<p>Just because it works and is stable doesn&#x27;t mean it doesn&#x27;t have security vulns.