This is a patch (mostly written by @doronbehar) we're using in the NixOS package for hal, where we have a policy of replacing those vendored dependencies we're sensibly able to with our own maintained versions (for reasons like security maintenance, patching to work around NixOS quirks, etc..).
Though I also understand that a lot of upstreams are awfully keen on their vendored dependencies, so we're fully prepared that you might not want to accept it.
This is a patch (mostly written by @doronbehar) we're using in the NixOS package for hal, where we have a policy of replacing those vendored dependencies we're sensibly able to with our own maintained versions (for reasons like security maintenance, patching to work around NixOS quirks, etc..).
Though I also understand that a lot of upstreams are awfully keen on their vendored dependencies, so we're fully prepared that you might not want to accept it.