bzlmod feels better at first but you're left navigating version conflicts anyways.

Vendoring deps is the only true real sane way for large repos