The PR for third party dependencies is "ready", with one known usability issue (the needed unregistering of submodules when those are updated). But we can do a follow up PR, it's not release blocking.