Submodules and even subtrees can be useful ways to link repos. But, I&#x27;m wary of commit ids as versions. From a commit id you can&#x27;t tell if the version you can is after the version that fixed a security issues. You can&#x27;t tell what version of the interface to the package you&#x27;re using. The meaning we are able to pull from and even compare with version number is missing. And, submodules are pinned to commit ids.