Git Submodules as a Package Manager: Why They're So Painful
Git submodules are often compared to a package manager, but they fall short in many ways. This article examines the gaps: resolution relies solely on URLs, installation leaves checkouts empty or dirty, storage duplicates objects across worktrees and nested submodules, and updating only supports branch-following. Security vulnerabilities have repeatedly exploited submodule parsing. The author argues that submodules expose git's internals directly, lacking the abstraction and convenience of dedicated package managers.
Most of the pieces are there and the behaviour roughly matches, but they don’t quite line up and the experience of using them is worse at almost every step.