only git submodules... for many years, in conjunction with vanilla melpa. happy w/ it!

what makes you choose a submodule vs just melpa, I know I've had issues with melpa getting the latest and it breaking, so I have to pin it, I'm guessing it's to ensure that stable versions don't change unless you want them to

The best example would be CIDER. They tend to have quite some code churn between releases, so it's hard for them not to break something for someone in each release. Say I'm happy with Cider 0.16. Even if I use the pinned-packages stuff, melpa-stable, etc I'll be forced to use a later version, which today would be 0.19. AFAICT there's no way to specify a version number/identifier. Which tdlr is my reason for submodules

i figured that was the case. wonder why melpa didn't factor in versioning

Same here, I started with Emacs Live (git submodules) and slowly moving to borg

There's an open issue for melpa stable providing old versions, but it's been open for a while, I think it's quite a lot of work to do it.

I just commit the /elpa folder with all it's dependencies into my dotemacs repo and used different branches to experiment with new releases (like new cider versions) in the knowledge that I can always inspect changes, and that master is always golden, irrespective of what is happening externally.