Unfragile

The request names 'git-vendor', which none of the candidate sources describes, so no product here is confirmed as git-vendor itself. The closest fit for managing and tracking vendored or dependency changes in git is git-pkgs, a git subcommand that indexes dependency changes from history 1. Other sources cover related but different jobs such as package managers or infrastructure tools.

A question back: Did you mean git-vendor as a specific tool (for example the Ruby or Go vendoring utility), and which language or ecosystem are you working in?

1
git-pkgsgit-pkgs.devwebsite read, tools not yet checked
A git subcommand that walks git history and builds a queryable database showing who added each dependency, when, and what changed between releases 1.
Website Docs
2
Poetrypython-poetry.orgverified and signed
Python dependency management and packaging tool that adds packages and writes a deterministic lock file 2.
Website Docs
for agents: dependency · dependency · packaging
3
Composergetcomposer.orgwebsite read, tools not yet checked
A dependency manager for PHP 6.
Website Docs

Sources

1git-pkgsgit-pkgs.dev · read 2026-10-29
2Poetry - Python dependency management and packaging made easypython-poetry.org · read 2026-10-29
6Composergetcomposer.org · read 2026-10-29

For agents: the 10 actions behind this answer

· git-pkgs website read, tools not yet checked
Dependency tools for git
dependency · poetry-core verified and signed
GET /addon/linkers · Bitbucket API verified and signed
List linkers for an app
· GitHits website read, tools not yet checked
Connect your software factory or coding agent to a version-aware index of open-source code, documentation, and package data. Discover, use, debug, and maintain dependencies through one interface.
· BuyAPI website read, tools not yet checked
BuyAPI helps builders choose APIs and infrastructure with current pricing, tradeoffs, evidence, and an open-source MCP server for coding agents.
· Getcomposer website read, tools not yet checked
A Dependency Manager for PHP
weaviate · weaviate-client verified and signed
pulumi/pulumi-package-publisher · Pulumi Package publisher verified and signed
A GitHub Action that publishes provider SDKs
· Vibgrate website read, tools not yet checked
Vibgrate scans your repository on your machine. It shows how far your stack has fallen behind, finds dependencies with known vulnerabilities, and gives your coding agent focused context from the code you actually run. Free, no account, raw source is not uploaded.
shell · shin-watcher-oss found in code, not yet checked
Run a shell command in the cloned BerriAI/litellm working tree. Use this for git, uv, curl, ls, cat, pytest, etc.

Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.