We use a lot of third-party extensions hosted either on GitHub or the Wikimedia servers that aren't maintained by us and therefore are not safe to include as externals in our repository.

This creates the problem of sometimes massively outdated third-party extensions. We don't want this, as there could be vulnerabilities or new features which users often appreciate.

We need to find a solution that allows us to, at the very least, track upstream changes to these extensions in one place so we know what we need to update. A better goal would be to find some method of updating those extensions more easily, however, this seems to be a major problem in the wider community that is/has received a minor amount of attention.