Do not vendor dependencies
Do not vendor dependencies

Struggled with the best approach to this, but in the end I agree with Dave Cheney.

Projects vendor, packages do not.

As a security package I do not wish to vendor dependencies into the package, as this then means that I am responsible for tracking all updates against the dependencies and updating ASAP for all security updates. Even if I did that, I do not have the mechanism to inform all projects that implement bluemonday to also update.

A better approach is to let the projects vendor the latest version of the dependencies along with bluemonday. Then if something like `golang.org/x/net/html` has a security update... the process of updating your vendored code would pull in the latest version of that regardless of whether I have updated the package. In the case of a critical CVE, this would mean that projects would need to wait for me to update bluemonday before they received the latest code... and I would prefer to be out of that equation so that projects could update their dependency and immediately receive the security updates.

As a result... I've taken the decision to not allow bluemonday to vendor 3rd party packages.
CMogilko/bluemonday